According to the Administrative Measures on Internet Forum Community Service and the Administrative Measures on Internet Comment, providers of Internet forum community services and providers of comment functions (together known as 'Speech Function Providers') are required to monitor the posts and comments, take action and report to the Cyberspace Administration of China if prohibited information has been published or discovered. In such situations, Speech Function Providers are required to cease transmission of the content, delete content or comments, restrict the comment function, close user accounts or sub-forums and revoke administrator powers (in the case of a forum). For news-related comment functions, the comments must be censored before being published. Speech Function Providers are also required to set up a complaints procedure in relation to posts and comments.

It is reported that China operates one of the world’s most sophisticated systems of internet censorship, commonly referred to as the Great Firewall, which restricts access to more than 200,000 websites and severely limits the availability of numerous international platforms and news sources. Most major global social media and messaging services, including Facebook, WhatsApp, Twitter, Instagram, Signal, Clubhouse, YouTube, Telegram, Snapchat, Line, Pinterest, and Grindr are blocked, as are many international news organisations and their Chinese‑language editions, such as The New York Times, Reuters, The Wall Street Journal, the Australian Broadcasting Corporation (ABC) and the British Broadcasting Corporation (BBC). Google’s search engine has been inaccessible in China since 2012, and Yahoo’s search function was similarly blocked in 2018.

The indicator "7.2.4 - Government Internet shut down in practice" of the V-Dem Dataset, which measures whether the government has the technical capacity to actively make internet service cease, thus interrupting domestic access to the internet or whether the government has decided to do so, has a score of 3 in China for the year 2025. This corresponds to "Rarely but there have been a few occasions throughout the year when the government shut down domestic access to Internet."

Art. 21 of the Cybersecurity Law requires network operators to appoint persons in charge of cybersecurity. Critical information infrastructure operators (CIIO) are also required to set up specialised security management bodies and persons responsible for security management. Further, CIIO's must conduct security background checks on those responsible persons and personnel in critical positions (Art. 34).

Art. 35 of the Data Security Law stipulates that where public security or national security authorities need to consult any data in order to safeguard national security or investigate a crime, the relevant organizations and individuals must provide such data. The same article stipulates that before getting access to the data held by private organizations, public security or national security authorities must go through strict approval formalities in advance.

Art. 18 of the Counterterrorism Law requires Internet service providers and the telecommunication sector to “provide technical support and assistance, such as technical interface and decryption, to support the activities of the public security and state security authorities in preventing and investigating terrorist activities.”

According to Art. 14 of the Measures for the Administration of Internet Information Services, ISPs must provide user information to the authorities upon request, without judicial oversight.

A basic legal framework on intermediary liability for copyright infringement is absent in China's law and jurisprudence. A safe harbour defence for internet intermediaries providing hosting services is spelt out in the Guiding Framework on Protection of Copyright for Network Dissemination (Art. 14-17, 22). The hosting defence established in Art. 22, only applies to service providers who host third-party materials. However, Art. 36 of the Tort Law of the People's Republic of China states that a "network service provider" shall assume the tort liability if it infringes "upon the civil right or interest of another person."
Furthermore, the Tort Law allows victims of the tort to notify the network service provider to demand the deletion, blocking or disconnection of the cause of infringement. Failing to do so can lead to further liability for the network provider in the event of further harm to the user. Finally, liability can be further increased in the event that the network service provider knew of the infringement but did not take action.

A basic legal framework on intermediary liability beyond copyright infringement is absent in China's law and jurisprudence. A safe harbour defence for internet intermediaries providing hosting services is spelt out in the Guiding Framework on Protection of Copyright for Network Dissemination (Art. 14-17, 22). The hosting defence established in Art. 22, only applies to service providers who host third-party materials. However, Art. 36 of the Tort Law of the People's Republic of China states that a "network service provider" shall assume the tort liability if it infringes "upon the civil right or interest of another person."
Furthermore, the Tort Law allows victims of the tort to notify the network service provider to demand the deletion, blocking or disconnection of the cause of infringement. Failing to do so can lead to further liability for the network provider in the event of further harm to the user. Finally, liability can be further increased in the event that the network service provider knew of the infringement but did not take action.

Art. 6 of the "Provisions on the Management of Mobile Internet Applications’ Information Services" stipulates that application providers offering services such as information dissemination or instant messaging must verify the real identity information of individuals seeking to register. Such verification shall be conducted using credentials including mobile telephone numbers, identification numbers, or a unified social credit code. Where users fail to provide authentic identity information, or unlawfully appropriate the identity details of organisations or other individuals to falsify registration, the relevant services must not be made available to them.

Pursuant to Art. 21 of the Counter-Terrorism Law, providers of telecommunications, internet, and financial services are obligated to verify the identities of their customers or clients and to withhold services from those who refuse to supply such information.

Art. 23.3 of the Cybersecurity Law stipulates that network operators must retain network logs for a minimum period of six months in accordance with the relevant regulatory provisions. Pursuant to Art. 78, the term network operators encompasses network owners, managers, and providers of network services.

Art. 4 of the Provisions on the Management of Internet Post Comments Services outlines the requirements for "post comment service providers" to verify the real identity information of registered users, adhering to the principle of "using a real name in the back end, while allowing either an alias or a real name at the front end." For individual users, identity verification may be conducted using mobile phone numbers and identification numbers. For corporate users, identity verification may be conducted through the use of uniform social credit codes. "Post comment services" refers to services provided by Internet websites, applications, and other website platforms of a public opinion nature or with the capacity to mobilize the public, for users to express text, code, emojis, pictures, audio, video, or other information through methods such as commenting, responding, leaving messages, realtime streaming comments, "liking", and so forth. Therefore, they include blogs, microblogs, instant messaging services, online discussion forums, news comment sections, among others.
The Provisions repealed a 2017 legislation of the same name, which already included a similar restriction in Art. 5.

Art. 31 of the E‑Commerce Law stipulates that operators of e‑commerce platforms must record and retain information relating to the goods and services offered on the platform, as well as transaction data, and must ensure that such information remains complete, confidential, and accessible. The retention period for records concerning goods, services, and transactions must not be less than three years from the date on which the relevant transaction is finalised.

The Measures for the Administration of Internet Information Services requires that Internet Service Providers (ISPs) keep records of each service user’s time spent online, user account, IP address or domain name, phone number and other information for 60 days and provide that information to the authorised government authorities when required (Art. 14). In addition, the Decision on Strengthening Network Information Protection requires ISPs to cooperate with the government and provide technical support upon inquiry from the authorised government authorities (Art. 10).