Deep synthesis
What goes into the user agreement, and what must users be told?
Basis: Provisions on the Administration of Deep Synthesis of Internet Information Services (互联网信息服务深度合成管理规定)
Conclusion: A provider shall formulate and publish management rules and platform conventions, improve the service agreement, and prominently prompt technical supporters and users to assume their information security duties. Where a function edits biometric information such as faces and voices, it must also prompt users to inform the person being edited in accordance with law and obtain that person’s separate consent. In addition, convenient channels for appeals and for public complaints and reports must be set up, with the handling process and feedback time limit published.
What you may need to do
- Draft and publish the management rules, platform conventions and service agreement
- State the information security duties of users and technical supporters in the agreement
- For face and voice functions, provide notice and a separate consent checkbox
- Launch appeal and complaint channels and publish the feedback time limit
Provisions relied on
Provisions on the Administration of Deep Synthesis of Internet Information Services (互联网信息服务深度合成管理规定) Article 8
A deep synthesis service provider shall formulate and publish management rules and platform conventions, improve the service agreement, perform its management responsibilities in accordance with law and the agreement, and prominently prompt deep synthesis service technical supporters and users to assume their information security duties.
Provisions on the Administration of Deep Synthesis of Internet Information Services Article 14
Where a deep synthesis service provider or technical supporter offers a function that edits biometric information such as faces and voices, it shall prompt deep synthesis service users to inform the person being edited in accordance with law and obtain that person’s separate consent.
One-line conclusion
The duties on the user-facing side consist of three documents plus one prompt: management rules, platform conventions and the service agreement must be formulated and published, and must prominently prompt technical supporters and users about their respective information security duties; wherever a function edits biometric information such as faces and voices, users must be prompted to inform the person being edited in accordance with law and to obtain separate consent. The appeal and public complaint channels are part of the same rule set.
Basis
Article 8: “A deep synthesis service provider shall formulate and publish management rules and platform conventions, improve the service agreement, perform its management responsibilities in accordance with law and the agreement, and prominently prompt deep synthesis service technical supporters and users to assume their information security duties.”
Article 14, paragraph 2: “Where a deep synthesis service provider or technical supporter offers a function that edits biometric information such as faces and voices, it shall prompt deep synthesis service users to inform the person being edited in accordance with law and obtain that person’s separate consent.”
Article 12: “A deep synthesis service provider shall set up convenient channels for user appeals and for public complaints and reports, publish the handling process and feedback time limit, and promptly accept, handle and respond to the outcome.”
What you need to do
- Produce three documents: management rules, platform conventions and the service agreement, each publicly readable on the website or in the application.
- In the agreement, spell out user duties by section (not producing, copying, publishing or spreading prohibited information or false news information) and technical supporter duties (cooperating with security management, remediating as required), and make the prompt prominent.
- For functions that edit biometric information such as faces and voices, show a notice at the point of operation and obtain consent separately; it cannot be folded into a blanket consent in the general terms.
- Open the appeal and public complaint channels, publish the handling process and feedback time limit, and keep records of acceptance and feedback.
- Keep a trail for rule updates: version number, what changed, effective date and how users were notified, all on record.
Common pitfalls
- Burying “separate consent” inside the general terms of the user agreement with one all-in checkbox. What the Provisions require is consent obtained separately for the editing of biometric information such as faces and voices.
- Prompting only users about their duties and forgetting that technical supporters must be prominently prompted too.
- Showing the rules once at registration and never notifying or recording later revisions.
- Making the appeal channel nothing but an email address, with no published process and feedback time limit and no feedback records.
- Letting the management rules, platform conventions and service agreement contradict one another, with inconsistent wording.
Frequently asked follow-ups
Q: If a customer uses the tool to swap faces, is the provider off the hook after giving notice? A: Notice is a legal duty, not a release from liability. The provider still has to implement content review, labeling, logs and handling; the actual allocation of responsibility follows the conduct and the applicable law.
Q: What makes consent “separate”? A: The core is not bundling it with general terms, obtaining consent for this specific processing — the editing of biometric information such as faces or voices — and keeping a checkable record. The local cyberspace administration office sets the operative reading on the concrete form.
Frequently asked follow-ups
- What is the difference between platform conventions and service terms?
- Article 8 requires both in parallel: management rules and platform conventions lean towards community and usage conduct, while service terms lean towards the rights and obligations of the parties. In practice each needs its own document, published.
- What can the platform do when a user breaks the rules?
- Article 10 allows measures in accordance with law and the agreement such as warnings, functional restrictions, service suspension and account closure, while preserving records and reporting to the cyberspace administration authorities and relevant competent departments.