China’s current certification requirements for telecommunications equipment are reported to conflict with its WTO obligations of limiting imported products to no more than one conformity assessment scheme and requiring the same mark for all products (Article 13.4.a of China’s WTO Accession).
China has three different licensing regimes: the State Radio Regulation of China (SRRC), the Network Access License (NAL) and the China Compulsory Certification (CCC). The CCC is required for a list of products that includes many types of IT products, such as video and audio equipment. The NAL is required for all telecommunications equipment in China. The NAL license requires extensive testing and support and may include network trials and review of the product by a local panel of experts, in addition to labouratory testing against China's national standards. Radio communication equipment intended to be marketed in China requires radio-type approval granted by the Ministry of Industry and Information Technology of the People’s Republic of China (MIIT)’s ‘State Radio Regulation Committee (SRRC). Specified equipment samples are tested in designated labouratories according to local Chinese standards.
Therefore, for a given piece of equipment, it can cost between USD 30,000-35,000 to test for all three licenses (SRRC, NAL, and CCC). The CCC mark is used for both Chinese and foreign products. Moreover, all testing for the CCC mark must be conducted in China, and US exporters are often required to submit their products to Chinese labouratories for additional tests.
The CCC certificate and permission to print the CCC mark must be renewed annually as part of a follow-up certification. Part of the follow-up certification is also a one-day factory audit.
China is also reported as having limitations on foreign -invested conformity assessment bodies in the country.

The Administrative Measures for the Multi-level Protection of Information Security (MLPS) require all IT systems in China to be classified into different levels of security, from one to five (with the most sensitive systems designated as level 5). In 2019, the MLPS 2.0 (composed by GB/T 22239-2019, GB/T 25070-2019, and GB/T 28448-2019) has expanded the definition of 'information systems' to broader systems, including network infrastructure, cloud computing systems, mobile application platforms, connected devices and industrial control systems.
The MLPS 2.0 requires networks of level 3 and above to adopt network products and services appropriate to their security protection levels. Under the MLPS 2.0, companies must self-assess their security management and compliance, and such assessment results must be evaluated and endorsed by the MLPS regulatory body.
The MLPS 2.0 requires companies in China to set up their cloud infrastructure, including servers, virtualised networks, software, and information systems. Such cloud infrastructures are subject to testing and evaluation by the Chinese government. Overseas operation and maintenance of Chinese cloud computing platforms must also follow Chinese laws and regulations. The national standards also state that customers' data and users' personal information processed by cloud service providers should be stored inside China, which is an additional requirement. It is currently uncertain how these national standards would be enforced, and there have not yet been reports of enforcement.

The National Security Law foresees the rollout of a “secure and controllable” internet infrastructure. Under the National Security Law, the State can establish national security review and oversight management systems and mechanisms, conduct a national security review of foreign commercial investment, special items and technologies, internet information technology produces and services, projects involving national security matters, as well as other major matters and activities, that impact or might impact national security.

Art. 26 of the Cryptography Law stipulates that commercial cryptography products relating to national security, the national economy and the people’s livelihood, or the public interest, may be sold or otherwise made available for use only after passing testing and certification conducted by duly qualified bodies. Art. 27 further requires that, where operators of critical information infrastructure procure network products or services incorporating commercial cryptography that may affect national security, such products or services must undergo a national security review conducted jointly by the national cyberspace administration, the national cryptography administration, and other relevant authorities. Art. 28 provides that the department responsible for commerce under the State Council, together with the national cryptography administration, shall impose import licensing requirements, in accordance with the law, on commercial cryptography possessing encryption functions and bearing upon national security or the public interest; however, such licensing is not to apply to commercial cryptography used in mass‑consumption products. The legislation does not, however, clarify what constitutes commercial cryptography used in mass‑consumption products, thereby generating uncertainty as to how this significant exemption will operate in practice.
More generally, it is reported that there are onerous requirements on the use of encryption, including intrusive approval processes and, in many cases, mandatory use of indigenous encryption algorithms (e.g., for Wi-Fi and 4G cellular products).

According to Art. 51 of the Postal Law of the People's Republic of China, a specific license is needed for express delivery business. It is reported that the administrative licensing for express delivery services is non-transparent and burdensome, preventing competition. It is reported that as companies are required to apply to each city where there is a postal administration department, they need to go through at least 350 review and approval processes if they want to operate at the national level.

China's first comprehensive legislation regulating e-commerce came into effect in January 2019. According to Art. 9, the law applies to all "e-commerce operators," including all individuals and legal entities selling goods and/or providing services on the Internet or other information networks. This includes operators of e-commerce platforms, sellers of goods and services on the e-commerce platforms of others, and those who operate their own websites or through other network services. The law is reported to extend to non-traditional shopping channels, including social media and messaging services, such as WeChat, and streaming sites, such as Douyin. According to Arts. 10-14, all e-commerce operators are obliged to obtain business licenses, register with the tax authorities, and ensure that information on their business and administrative licenses related to their business services is displayed online in a readable form at all times.

According to the Administrative Measures on Internet Forum Community Service, providers of Internet forum community services are required to obtain and verify the identity information of users and enter into service agreements with them.

According to Art. 19 of the Counter-Terrorism Law issued in 2016, telecom operators and Internet service providers shall establish content monitoring and network security programs. Likewise, companies are required to adopt precautionary security measures to prevent the dissemination of information on extremism, report terrorism information to the authorities in a timely manner, keep original records, and promptly delete such messages to prevent further circulation. The law introduces both pecuniary fines and detentions up to 15 days for telecommunications operators and ISPs personnel who fail to “stop transmission” of terrorist or extremist content, “shut down related services,” or implement “network security” measures to prevent the transmission of such content.

According to Art. 7 of the Administrative Provisions on Information Services of Mobile Internet Application Programs, app providers are required to monitor online content and report violations to government authorities. App providers and app stores must not use apps to endanger national security, disrupt the public order, or produce, reproduce, publish, or disseminate content banned by laws and regulations, according to the Provisions. In addition, app providers must monitor banned content and take action against users that publish banned content by issuing warnings, restricting functions, stopping updates, or terminating accounts. They must also keep a record of the violations and report the matters to relevant government authorities. In addition, according to Art. 8, app stores are required to verify the legitimacy of app providers and ensure app providers protect user information and publish lawful content. App stores are required to take action against offending app providers by issuing warnings, suspending their publications, or removing the aberrant apps from the stores. App stores are also required to keep records of the violations and report them to the relevant government authorities.

Under Chapter III of the Provisions on the Governance of the Online Information Content Ecosystem, content service platforms are obligated to establish and implement a governance framework aimed at fostering a "network information content ecology" in accordance with the Provisions. The platforms are also encouraged to promote permissible information and prohibit forbidden content, while being required to prevent the dissemination of information deemed necessary to suppress. Art. 34 further mandates that platforms adopt appropriate measures against individuals or entities responsible for producing, copying, or disseminating prohibited information. These measures may include issuing warnings, requiring corrections or other forms of rectification, imposing functional restrictions, suspending updates, and closing accounts, in accordance with relevant laws and contractual obligations. Additionally, under Art. 10, platforms are required to promptly remove illegal content, maintain records of such activities, and report these matters to the relevant authorities. Furthermore, Arts. 13, 14 and 15 stipulate that platforms must, among other obligations, develop and provide online products and services suitable for minors, enhance the monitoring and regulation of displayed advertisements, and establish a credit management system for user accounts, along with providing corresponding services as necessary.
Art. 41 of the Provisions specifies that the content service platforms mentioned in these Provisions refer to network information service providers that offer services for the dissemination of network information content.

According to the Administrative Measures on Internet Forum Community Service and the Administrative Measures on Internet Comment, providers of Internet forum community services and providers of comment functions (together known as 'Speech Function Providers') are required to monitor the posts and comments, take action and report to the Cyberspace Administration of China if prohibited information has been published or discovered. In such situations, Speech Function Providers are required to cease transmission of the content, delete content or comments, restrict the comment function, close user accounts or sub-forums and revoke administrator powers (in the case of a forum). For news-related comment functions, the comments must be censored before being published. Speech Function Providers are also required to set up a complaints procedure in relation to posts and comments.

It is reported that China operates one of the world’s most sophisticated systems of internet censorship, commonly referred to as the Great Firewall, which restricts access to more than 200,000 websites and severely limits the availability of numerous international platforms and news sources. Most major global social media and messaging services, including Facebook, WhatsApp, Twitter, Instagram, Signal, Clubhouse, YouTube, Telegram, Snapchat, Line, Pinterest, and Grindr are blocked, as are many international news organisations and their Chinese‑language editions, such as The New York Times, Reuters, The Wall Street Journal, the Australian Broadcasting Corporation (ABC) and the British Broadcasting Corporation (BBC). Google’s search engine has been inaccessible in China since 2012, and Yahoo’s search function was similarly blocked in 2018.

The indicator "7.2.4 - Government Internet shut down in practice" of the V-Dem Dataset, which measures whether the government has the technical capacity to actively make internet service cease, thus interrupting domestic access to the internet or whether the government has decided to do so, has a score of 3 in China for the year 2025. This corresponds to "Rarely but there have been a few occasions throughout the year when the government shut down domestic access to Internet."

According to Art. 10 of the Administrative Regulations for Online Publishing Services, Chinese-foreign equity joint ventures, Chinese-foreign cooperative ventures, and foreign-funded entities are prohibited from engaging in online publishing services. Moreover, according to Art. 8, any publisher of online content, including texts, pictures, maps, games, animations, audio, and videos, must store its necessary technical equipment, related servers, and storage devices in China. Furthermore, any online publication service unit needs to get prior approval from the State Administration of Radio, Film, and Television (SARFT) if they want to cooperate on a project with any foreign company, joint venture, or individual.

According to Art. 5 of the Provisions on the Administration of Internet News Information Services, Internet news providers are required to obtain a permit to provide Internet news information services to the social public through Internet websites, application software, forums, blogs, microblogs, public account, instant messaging tools, online live streaming and other such methods. In addition, pursuant to Art. 6 of the Provisions, the applicant’s person-in-charge or chief editor must be a Chinese citizen, and the applicant shall have a legal person legally established within the territory of the People's Republic of China. Furthermore, the applicant must separately obtain an Internet Content Provider (ICP) license or an ICP filing from telecom industry regulators. According to Art. 16 of the law, without an ICP number, a website can be shut down by the hosting provider with no notice.
Furthermore, all privately operated news services are obligated to have their operations overseen by personnel endorsed by the ruling party. Editorial staff working on these platforms need approval from national or local government internet and information offices, and their employees are required to undergo training and obtain reporting credentials from the central government. The Provisions on Administrative Law Enforcement Procedures for Internet Information Content Management set out the procedural and administrative processes for the Cyberspace Administration of China to enforce the laws and regulations relating to Internet content.