Since the beginning of the “post-centralization” period, which began with Xi Jinping’s major reforms of China’s cyber institutions in 2014, the CCP has vastly expanded its censorship apparatus in an effort to exert control over China’s domestic internet.¹ Vectors range from app store-level censorship and rectification campaigns, to tightened content moderation.² Below, we detail the ideological and legislative development of online identifiability through RNR requirements and explain how these policies are strategically developed to monitor domestic debate and exclude foreign users.

China’s three-zone problem: An ideological security firewall around the “red” internet

China’s RNR system is the most critical feature of social surveillance³ and a core element of the CCP’s effort to attain its most important strategic goal: ensuring “domestic stability” (维稳) — an ongoing campaign to suppress internal opposition⁴ and prevent civil unrest of the kind that led to the Color Revolutions or the Arab Spring.⁵

In a 2013 speech at the National Propaganda and Ideological Work Conference, Xi Jinping addressed the challenges posed by global internet to China’s regime stability.⁶ In doing so, he conceptualized domestic ideological cohesion and global public opinion in three zones (三个地带): a red one, a black one, and a grey one. Per Xi, China itself represents the inner “red zone,” which needs to be controlled by mainstream media and the state propaganda apparatus. Outside this red zone exists a “black zone” filled with hostile narratives and subversive ideas, such as “universal values.” In between the inner (red) and the outer (black) zones liesa “grey zone” which acts as battlefield (战场). According to Xi, the internet should be treated as the “biggest variable” (最大变量) in this grey zone, as “hostile forces” (敌对势力) will continuously use it to try to shape andm anipulate “threats from within” (心头之患) to topple China.⁷

The red zone must be consolidated and expanded, so that its social influence broadens incessantly. We must dare to enter the black zone, we must dig into the belly of the Iron Fan Princess to fight, and progressively push it to change colour. In the grey zone, we must launch large-scale work, to accelerate its transformation into a red zone and prevent it decaying into a black zone.

Xi Jinping, 2013⁸

The party state has since operationalized this Tri-Zone internet framework. As a result, China’s domestic online discourse (i.e., the inner red zone) is continuously transformed into what the CCP refers to as “a healthy and orderly online ecology” (健康有序发展), or “a clean and healthy cyberspace” (风清气正的网络空间).⁹ Achieving this entails purging China’s internet of regime critique and liberal or progressive political concepts, such as “press freedom,” “universal human rights,” or “constitutional democracy.”¹⁰ Content that could “undermine national unity” (破坏国家统一), “damage national honor” (国家荣誉), or advocate “separatism” (分裂思想) must also be actively excluded. Accordingly, it is now a priority for the CAC (China’s powerful cyber regulator) to “maintain control in the online information space and prevent organized opposition [regarding] public opinion properties and social mobilization capability.”¹¹

As China’s domestic control and censorship apparatus has grown, the need to monitor and throttle the exchange of information (information penetration “信息渗透风险”) with the rest of the online world has intensified. Online nationalists and the broader propaganda apparatus increasingly warn about the grey zone, through which “Western stories” (西方故事) and “anti-China content” (反华内容)¹² can infiltrate China and blur the vision of public intellectuals,¹³ or even that of party members¹⁴ and military leaders.¹⁵

In this ongoing battle, the private tech sector is the first line of defense for China. It is this sector’s responsibility to “guide and direct netizens’ cognition of things” and ensure “discourse security” (话语安全). Non-traditional security actors, such as operators of social media apps and internet companies, protect the grey zone as a form of “cyber ideological security.”¹⁶ In turn, party intellectuals often refer to these actors as the “national cybersecurity barrier” (国家网络安全屏障)¹⁷ or “ideological security firewall” (意识形态安全防火墙) that prevents the spread of false and harmful content within China.¹⁸

The ability to monitor and control the grey zone — and prevent any political discourse that could poison China’s inner red zone — is therefore invariably connected to the question of who can access and engage with Chinese social media.

Legislative background: Full identifiability on China’s internet through phone number registration

To reinforce China’s ideological security firewall, the party-state seeks to reliably and consistently tie online actions to offline identities. Therefore, domestic internet companies must require identifiability as a condition to access their services. User phone numbers, as well as face and identification card (ID) scans, are commonly used to ensure RNR compliance. Comprehensive provisions released in March 2021 and September 2022 clarify that identification information must be collected for virtually all services related to internet access, including DNS resolution and the provision of messenger services (see Appendix 2). With the exception of using search engines, RNR turned into a general access condition for the internet in China.¹⁹ This is the culmination of over a decade of iterative regulatory processes building upon three important benchmarks from 2010, 2015, and 2017.

First, RNR has been mandatory for the acquisition of mobile phone numbers in China since 2010. Per a decision by the National People’s Congress, China’s three state-owned telecom providers must verify identities whenever a SIM card is sold.²⁰ The goal of this regulation was to link phone numbers to IDs as well as real-time geolocation data.²¹ In practice, however, RNR practices were still being debated amongst intellectuals and party members at the time of the decision²² and implementation of its requirements initially stalled,²³ with various regulatory updates to follow.²⁴ For example, since 2019, users have been required to submit facial recognition scans upon purchase.²⁵ See Appendix 2 for a more comprehensive legislative overview.

Second, the CAC introduced the online account management principle referred to as “front-end anonymity/back-end identification” (“后台实名、前台自愿") in 2015. According to this principle, any internet information service provider (互联网信息服务提供者) must ensure the verification of users, while users retain the ability to engage anonymously on the platform.²⁶

Finally, the Cyber Security Law (CSL) of June 2017 implemented identifiability across most parts of the Chinese internet. Article 24 of the CSL stipulates all network operators (网络运营者) must require users to providereal identity information.²⁷ Throughout 2017 and into 2018, the party-state also considerably increased its pressure on internet companies to enforce RNR policies and protect national security interests (see Appendix 2). The policies were explicitly mandated to ensure regime stability, increase self-censorship, and enforce the ideological firewall.²⁸

Registering user phone numbers is one way for internet information service providers to comply with the “back-end identification” requirement, as the party-state can ensure identification through its access to the data at the three telecom providers. As a result, in 2016, a spokesperson from the Ministry of Industry and Information Technology claimed that 92% of SIM cards in China had been successfully linked to identification information.²⁹ This high identification rate of phone numbers allows internet service providers to use phone numbers as a proxy for the identification requirements while handling very little private information.³⁰ In China’s internet economy, which runs largely on mobile devices, phone numbers (+86) remain aubiquitous and low-tech quasi-identifier for account registration (see Figure 2).

However, because China’s RNR systems relied on a complicated handover of data between service providers and telcos, the CAC initiated a national authentication service in 2024 in an attempt to streamline and nationalize China’s identification system.³¹ Under this new service, users will be provided with national internet IDs (issued by the CAC) and that internet service providers are required to accept as authentication data.³²

At the core of this national service lies a centralized database of “trusted identities,” which the Ministry of Public Security first experimented with in 2014 to provide a technical backbone for RNR-related communication between public and private entities (see Figure 3).

The Cyber Trust Identity (CTID) platform allows Chinese apps and internet service providers to verify phone numbers against registered IDs. As of 2020, the three-layered platform conducts about 15 million authentications every day. It contains a central database, including identification documents of various administrative agencies and phone numbers, verified by national telecommunication carriers (Layer 1). This allows third-party authentication service providers(Layer 2) to verify users on commercial online services, such as WeChat and Alipay³³ (Layer 3).

CTID operators claim the platform grew from 26 institutional clients in 2020 to clients from 50 industries and 350 institutions by 2022,³⁴ gathering an astonishing 5 billion pieces of identification information along the way, including ID cards, passports, and data from residents in Hong Kong, Macao, and Taiwan.³⁵ The CTID has also been developed to facilitate biometric recognition, including facial, fingerprint, voice, and gait recognition — with the goal of eventually replacing IDs and passports.³⁶

Level 3: Commercial authentication layer
Level 2: Third-party verification
Level 1: Legal and trust layer

Source: OIDAA, “CCTID Platform: Strategic Practice of China’s Network Trusted Identity with Chinese Characteristics” [CTID平台：中国特色网络可信身份战略实践], June 19, 2020.

Background: The idea of a national “network trust system” (网络信任体系) was first conceptualized in August 2008 by the Ministry of Human Resources and Social Security (MOHRSS). At that time, the ministry also suggested users should only be permitted to access the internet once their identity had been verified.

In 2014, the Ministry of Public Security (MPS) was mandated to build a “network trust system with Chinese characteristics” (中国特色的网络可信体系) to digitalize and unify all identification processes on China’s domestic internet.

Building on efforts by MOHRSS, the MPS in 2017 officially started working on the CTID, previously referred to as the “internet + trusted identity authentication platform” (互联网+可信 身份认证平台) or the “national network identity authentication public service platform” (国家 网络身份认证公共服务平台).³⁷

In 2024, the MPS and the CAC proposed a national internet ID system to centralize and nationalize user verification and the handling of personal data.