Privacy Violation · Full chronicle and history

According to a netizen submission, during the recent county-level People's Congress election in Anyang, Henan, government departments used household registration information to verify voter identities, allowing them to access personal information in the system backend and cast votes on behalf of voters without needing their ID numbers.

On November 9, anti-trafficking volunteer Shangguan Zhengyi posted that shortly after purchasing a ticket the previous night, he received a private message from the Kuaishou account "Mianbei Adong" inquiring about his itinerary, suggesting a potential leak of his private information.

On November 8, MeT, who first posted the content, responded that he had not clarified the activation conditions for the screen recording at the time, and reiterated that it was Xiaomi's system security component that performed the recording.

On November 7, Bilibili creators epcdiy and Bian Liang released videos claiming that after Xiaomi's "AI Call Warning" is enabled and authorized, the phone will record about 3 seconds of screen footage during WeChat and QQ video calls, encrypt and upload it to the cloud to determine if it involves fraud, and continue recording after about 2 seconds if no risk is detected; this feature is disabled by default.

On November 5, anti-peeping volunteer Zhou Ninghe revealed that peeping incidents exist in all 34 provincial-level administrative regions in China. According to his statistics, approximately 140,000 women have been victims of peeping. Over the past year, he has assisted the police in solving 18 peeping cases, two of which involved minors.

A behavioral analysis report of the Honor HiView four-piece APK suite submitted by a netizen shows that its log component can read the list of installed apps, track usage duration, receive cloud pushes, execute debug commands, and capture network traffic, with the upload module containing a device serial number field; another module can determine whether an operation is an automated script based on operational data.

A V2EX forum post on November 5 sparked discussion. Researchers conducted a reverse analysis of Xiaomi HyperOS and discovered that the SystemHelper component collects and reports app lists, usage duration, IMEI, SIM card information, and location data to China Unicom servers. They also decrypted reported data for 169 app entries from a test phone.

Recently, an out-of-town tourist posted that after scanning the QR code to log into the "Mango Shared E-bike" mini-program at Wuhan University, they were logged out for not being a student or staff member. Just two minutes later, a private individual added them on WeChat using their phone number, raising suspicions that the mini-program has a risk of leaking personal information.

On November 4, 2026, X user kiraequal performed ADB dynamic forensics and DEX reverse engineering on a locked-bootloader Xiaomi 13 Pro (HyperOS 3.0). They discovered that the system's Security Center contains a built-in anti-fraud database named 'fraud_detection_data.db', where the 'voip_record' table involves silent screen recording logs of QQ and WeChat voice and video calls.

[Follow-up · November 4, 2026] On November 4, X user KiraEqual posted after disassembling a Xiaomi 13 Pro running HyperOS 3.0, stating that the pre-installed anti-fraud component can record screens, record audio, and log network call details without triggering any authorization pop-ups. Another researcher verified that on some models, screen recording covers the entire screen, and even after turning off the protection switch, the screenshot time is still recorded.

Media reports indicate that Nanjing University's Xianlin Campus has implemented a smart classroom system equipped with facial detection and intelligent recognition algorithms, which tracks real-time attendance and head-up rates, sparking criticism over privacy violations.

On November 3, a netizen posted that screenshots from the Android version of Taobao taken a few months ago contained invisible watermarks, which were visible when zoomed in. The user encountered significant trouble after sending the screenshots to others. In the comments section, some netizens claimed they had received calls from customer service demanding they delete posts after sharing Taobao shopping screenshots, while others confirmed they had also discovered the watermarks.

On November 2, a netizen posted that the China Unicom 'SystemHelper' program, pre-installed on phones from brands including Xiaomi, OPPO, vivo, Samsung, OnePlus, and Realme, can collect information on app installation and usage, data traffic, and device identification. This reporting can be triggered even when using a non-Unicom SIM card, and the program reportedly does not check whether the user has consented to the privacy policy.

On October 31, a developer checked a friend's Xiaomi 14 and claimed to have found pre-installed components reporting the application list to Xiaomi and China Unicom servers, and that security components contained code for encrypting and uploading approximately 3-second screen recording clips to the cloud for detection.

On October 19, a bank employee in Guangdong posted a notice from their workplace group chat requiring unmarried employees to share their parents' WeChat contacts and married employees to share their spouses' WeChat contacts with grid administrators, to be completed within the same day. Netizens said some banks also demand parents' ID numbers, job titles, and their children's school and class information, and even home visits.

On October 12, a netizen posted that China Unicom had used their information to open 30 mobile SIM cards without their knowledge or authorization; after discovering this, China Unicom's Jilin Changchun branch canceled and transferred the relevant phone cards in the person's absence.

On October 10, a person claiming to be a senior mathematics student at a 985 university posted asking for help, saying that his college entrance exam preferences had been secretly altered by his parents, causing him to fail and repeat a year; 9 cameras had been installed at home to monitor him; he was diagnosed with severe depression; he received two academic warnings for failing courses and now faces the risk of being expelled, sparking heated discussion among netizens.

On the evening of October 1, Ms. Guo and two others paid 282 yuan to rent a homestay in Pingtan, Fujian in full. After showering, they went naked into the living room to get clothes. Afterwards, they checked the camera's memory card and confirmed the footage had been recorded. The landlord admitted to installing it and said the device was not connected to the network.

On September 26, a netizen said that they were clearly filmed by a news video while passing through customs. The criminal suspect in the footage was pixelated, which led to them being misidentified and subjected to online attacks; they contacted the media to request a correction to the video but received no response.

On September 18, a 28-year-old netizen posted that when applying for a Hong Kong and Macau travel pass in another city, the police station of their household registration called their parents and relatives to inquire about their travel intentions and verify if they knew about it. Police explained this was for safety reasons, but the individual believed their privacy and itinerary as an adult were improperly disclosed.

On September 3, a netizen reported that having worked abroad for many years, the village secretary in their hometown demanded through family members to submit information such as departure time, phone number, and working city. After submission, the village secretary further demanded the name of the specific employer, claiming it was for record-keeping according to a document issued by the provincial government.

On September 11, a female mainland student was filmed with a hidden camera in the women's restroom at a university in Macao's Islands District. On September 12, police arrested a mainland male university student in his 20s in the campus dorms. Police found 28 voyeuristic videos and 10 photos involving multiple female students on his device. The suspect confessed to committing the crime due to high academic stress and has been referred to the Public Prosecutions Office for investigation.

On August 4, a Chinese man in his 20s was arrested for illegally filming women at a cafe in Seongdong-gu, Seoul. Police investigation revealed that he had illegally filmed a total of 27 women across various locations in Seoul. On September 9, the Seoul Eastern District Prosecutors' Office indicted the man without detention on charges of violating the Act on Special Cases Concerning the Punishment, etc. of Sexual Crimes.

On September 15, a WeChat PR employee responded to privacy controversies surrounding the AI assistant "Xiaowei," denying that it peeks at chat logs, but admitting that recommendations are made based on user interaction data. Earlier updates to WeChat's privacy policy showed that using Xiaowei collects user input and information viewed within the scenario.

On September 11, 2026, a senior student disclosed on an online forum that a class group at his university posted a “Student Information Collection” document, requiring students to fill in their ID numbers, detailed home addresses, and parents' workplaces and submit them to the new class advisor. The student and his classmates expressed concerns about the public form, saying the information would be visible to the entire class, and ultimately none of the classmates filled in that section. The incident has sparked controversy over personal data protection in higher education.

On September 11, 2026, a netizen posted on a social platform stating that when using the university learning software “Zhidao”, even after closing the app and clearing the background, after turning on VPN a prompt “VPN environment detected, please adjust network” still appears. The netizen worries this prompt could be monitored by the school and affect credits or graduation. Zhidao belongs to Zhihui Tree Net, and its privacy policy effective from July 1, 2025 states that the platform will collect device identifiers and IP in the background, and may provide abnormal learning behavior data to the school after school authorization.

Cameras were installed in the men's restroom of an office building in the Sany Heavy Truck Park in Changsha, Hunan, and the matter was exposed by netizens' submissions.

On September 4, 2026, a college student revealed that the school required students to report and document their travel history during the summer break to designated provinces and overseas, using a publicly editable online form to collect the information, sparking controversy over infringement of personal privacy.

Hu Xijin wrote that Sun Yuchen can pursue the 30 million yuan through litigation or publicly express his dissatisfaction, but should not use a property dispute to make his ex-girlfriend's private information public.

A payroll list for permanent staff at Dongguan Furong Temple for September 2026, exposed by netizens, shows that 22 out of 29 permanent staff members earn over 10,000 yuan, with the abbot alone receiving nearly 18,000 yuan. The total for the entire list is nearly 320,000 yuan.

National Business Daily reported that "Xinzhua", a Chengdu face-authorization platform, trades the portraits of influencers and ordinary people at listed prices, completing nearly 70 deals with a transaction value of 40,000 yuan in the two months since launch.

On August 26, 2026, a resident in Guangxi discovered that while purchasing ritual paper offerings, the inner pages of the paper were printed with numerous copies of citizens' ID cards and documents stamped with government seals, raising public concern about the leakage of personal privacy.

The US Department of Justice announced a $400 million settlement agreement with TikTok and ByteDance to resolve a civil lawsuit regarding children's privacy protection.

On August 20, 2026, a technical developer released an analysis report pointing out that Alibaba's cross-border e-commerce platform, AliExpress, silently invokes WebAudio via security scripts in its webpage backend to generate audio signals, which are combined with various hardware parameters to create deep device fingerprints.

On August 12, 2026, media released an in-depth undercover investigation revealing that online black market operators are promoting modified hidden camera devices and controlled anesthetic drugs in the comment sections of social platforms, and enticing buyers to send back privacy videos.

On August 11, 2026, a student rights platform revealed that teachers at Hechang Middle School in Lüliang, Shanxi, forcibly searched the WeChat and Douyin private messages and personal photo albums of several female students on the pretext of investigating a conflict; the school subsequently acknowledged that this was indeed inappropriate.

On August 11, 2026, Shanxi Medical University First Hospital issued a statement regarding a nursing intern who publicly posted photos of an obstetrics operating room scene and unblurred privacy photos of a female patient on WeChat Moments; the hospital has set up an investigation team to handle the matter seriously in accordance with regulations.

On August 11, 2026, the principal of a martial arts school in Jiyuan, Henan, posted a night patrol video on social media. Late at night, he entered the dormitory with a flashlight, forcibly lifted the bedding of students in bed, checked their undergarments, and filmed and published the footage. After drawing criticism for violating privacy, he took it down.

Huang Baiwei is alleged to have purchased household registration data containing approximately 23 million Taiwanese people using 5,000 Tether, and used the relevant personal information for intimidation and harassment.

Taiwanese investigative agencies are investigating Wang Dawei for suspected illegal searches, intimidation, harassment, and purchasing personal data from the dark web; related cases previously failed to proceed with prosecution because the victims did not appear in court.

The Taipei District Prosecutors Office cracked a major personal data leak case. Suspects Wang Dawei and Huang Bowei are alleged to have purchased from the dark web as many as 50 million records of household registration and labor and health insurance data covering all of Taiwan, used them to threaten dissidents online, and published the personal information of public figures including Jensen Huang. Wang Dawei has been indicted by prosecutors.

In the early hours of August 5, 2026, a young woman from out of town staying at a Beijing hotel reported that local police officers knocked on her door at 3 a.m., entered her room, and forcibly demanded to inspect her personal phone; after she refused, they said they had received orders.

Companies such as “Gangganghao Film and Television” obtain real people's likeness authorizations through AI digital artist contracts and AI live-action short drama actor recruitment, and charge authorization fees by the number of short dramas or by time.

A bank employee listed their portrait on the "Xinzhua" platform and had it bought by advertising companies seven times within three days, earning 500 yuan per license and nearly 2,500 yuan after the platform's cut.

In August 2026, a citizen who had been living abroad for a long time posted to disclose that after returning home he was repeatedly summoned by the police and was forcibly required to unlock his phone so that the police could carry out a deep data collection lasting up to two hours.

In July 2026, it was reported online that an AITO M8 owner in Shanghai complained that the vehicle's location could still be viewed after permissions were revoked; a WeChat group chat shows Yu Chengdong issuing a stern directive demanding an immediate fix and the dismissal of employees who delayed the resolution.

On June 27, 2026, a hands-on test by Taiwan's The Reporter revealed that China's Amap, while not logged in on iOS, uploads high-precision GPS location and device sensor data to Alibaba Cloud servers on the mainland on average every 3 seconds, raising national security and privacy concerns.

On May 28, 2026, students at Shanghai University of Political Science and Law discovered a functioning hidden wireless covert camera device above the partition of a women’s restroom in the Zhiyuan Pavilion study building. The device was capable of transmitting footage remotely. The device in question was subsequently handed over to the Security Office and a police investigation was launched.

On May 26, 2026, the Chengdu Jinniu Public Security Bureau announced that two suspects were apprehended for illegally installing secret recording devices in the restroom of a certain influencer shop and profiting by selling videos of others' privacy; one was approved for arrest by the procuratorate, and one was released on bail pending trial.

The head and deputy director of the Shanggao County Public Security Bureau in Jiangxi Province abused their official authority, using an intermediary to illegally provide buyers with citizens' bank account information at a price of 1000 yuan per record; the related judgment has been published on the Court Judgment Website.

It is reported online that the 13-year-old daughter of Baidu Vice President Xie Guangjun, a fan of South Korean star Jang Wonyoung, doxxed a pregnant netizen on Weibo following a controversy over comments about the star, and posted information showing her father's monthly salary of 220,000 yuan.

Baidu Vice President Xie Guangjun publicly apologized for his daughter doxxing a pregnant woman, stating he feels deeply guilty and offers a solemn apology.

A netizen submitted a report claiming that Huawei's HarmonyOS NEXT system has a built-in website blocking function based on online detection, consistent with the blocking in Huawei phones' stock browser, and that every URL a user visits is uploaded to Huawei.

Wang Dawei was accused of harassing Jensen Huang in 2025 and publicly disclosing Jensen Huang's ID number; Jensen Huang subsequently filed a lawsuit.

US National Public Data leaked 272 million records of case-related numbers paired with names and addresses, and they are available for free download on hacker forums.

Washington Post reporter Kader reported from a field visit that a village in Henan had images of facial expressions and occlusion states collected, and the villagers were paid with a bottle of cooking oil.

A vocational school in Chongqing purchased a facial recognition system worth $124,000 to monitor students' sleep, recording information such as identity, contact details, dormitory bed numbers, and daily routines.

In 2018, the Starwood database under Marriott Hotels was breached, exposing data on approximately 383 million travelers, with passport numbers, travel records and other information all exposed.

In 2015, about 80 million medical records were stolen from the second-largest health insurance company in the United States, cited as one of the cases linked to a China-backed information theft campaign.