GB/T 47469-2026Data security technology - Management guidance for smart mobile terminals on the personal information processing activities of mobile internet applications (English PDF)

7.2 Transparent Display

7.2.1 Notice Regarding the Collection and Use of Personal Information During periods when an app continuously or frequently requests permissions that allow the collection of personal information (such as microphone, camera, and location permissions), the mobile smart terminal... Prompt users through methods such as displaying icons. When displaying icons, the following elements should be considered.

a) Display method. Displayed in a prominent position on the screen, including but not limited to the status bar at the top of the screen, a colored icon in the corner, or a drop-down menu. Column display, etc.;

b) Timing of notification display. When the app is running in the foreground and background, the user is notified that the app is using permissions that allow the collection of personal information;

c) Brief Explanation of Logo Meaning. Provide users with a brief explanation of the logo's meaning;

d) Permission Query and Adjustment. Allows users to query the names of apps that are currently using permissions to collect personal information, and to grant permissions accordingly. The status needs to be adjusted.

Note. Frequent calls refer to calls made at short intervals, resulting in a continuous call effect.

7.2.2 Records of Personal Information Collection and Use Mobile smart terminals record the personal information collected and used by apps, and provide statistical and query interfaces for users. The system provides a clear overview of how personal information is collected and used, and the behavioral records take into account the following factors.

a) Recorded actions include, but are not limited to. 1) Read location information, read contacts, read media information (such as pictures, audio and video), read text messages, and read biometric information. Data collection, reading unique device identifiers (such as IMEI, WLAN MAC address), reading call logs, accessing the microphone, Camera, background screenshot/screen recording behavior; 2) App auto-start and associated startup behaviors; 3) Record the behavior of reading the application list and reading clipboard information.

b) Display of recorded information, including but not limited to. 1) When statistics are based on total volume, the displayed information includes the App name, the behavior name, and the total volume data; 2) When counting actions by frequency, the displayed information is either the last detail or the details for each individual action. The details include the App name, The action name, action start time (time precision at least in minutes), and the current app version should be displayed in an appropriate location. information; 3) If the app frequently reads location and media information, to avoid displaying a large amount of invalid information to the user, the last... For a single detail or the total amount within a certain period, other behaviors should display details for each instance.

c) The mobile smart terminal shall retain information about the user's collection and use of the mobile smart terminal's personal data for no less than 7 days, depending on the terminal. Different configuration levels require setting reasonable save thresholds, or providing users with threshold adjustment functions.

7.2.3 Centralized display and management of personal information collection and usage behavior To facilitate users' access to and management of their personal information collection and usage, mobile smart terminals provide a centralized display of personal information collection data. A unified portal for collecting usage information and providing users with a platform to manage their personal information, including the following.

a) Mobile smart terminals provide a unified entry point in a prominent position in the second-level directory of the settings interface.

b) Displaying and managing content includes. 1) View the App's records of collecting and using personal information; 2) Provide a management interface related to personal information, such as permissions to collect personal information.

7.3 Management of Personal Information Processing Behavior

7.3.1 Personal Information Authorization Management Mobile smart terminals provide different levels of authorization for personal information management, including the purpose of permission requests for collecting personal information. The surface provides corresponding mechanisms, including.

a) Single-use authorization method. When the app requests location access, camera access, or microphone access, authorization is granted to the user for this single use. The mechanism requires that when a user restarts the app and uses location, camera, or microphone-related functions, the user's location data needs to be retrieved again. Authorization;

b) Authorization methods permitted only during use. When the app requests location access, camera access, or microphone access, provide the user with... An authorization mechanism that allows access only when the app is running in the foreground; Note

1.Foreground running status refers to the application or application process being a task currently known to the user.

c) Editable Permission Request Purpose. Supports editing the purpose description of permission requests to collect personal information during the App development stage. Please display the permission to collect personal information in the pop-up window;

d) Automatic permission reset mechanism. When a user has not used an app for an extended period (e.g., 3 months), the system will automatically reset the permissions of the app. The ability to reset the permission to collect personal information to an unauthorized state; when an app uses the permission to collect personal information again, it must... Regain user authorization. Note

2.Users can manually enable or disable the automatic permission reset function through the interactive interface.

7.3.2 Terminal Sensitive Behavior Management Mobile smart terminals provide management mechanisms such as prompts and access control for sensitive behaviors on the terminal, specifically including the following mechanisms. sensitive behaviors Examples of management measures are shown in Appendix A.

a) Application List Access Control. Mobile smart terminals manage the list of applications accessed by apps on the mobile smart terminal. In principle, an app obtains a list of applications with the user's authorization, and the authorization methods provided to the user include always allow and deny.

b) Clipboard information access control may employ one or more of the following mechanisms. 1) When the App reads clipboard information without being actively triggered by the user, prompt the user. 2) Mobile smart terminals manage clipboard information, and apps access clipboard information with user authorization.

c) Screenshot Control Mechanism. Mobile smart terminals provide a screenshot management mechanism, which can be invoked by the App with user authorization. Screenshot function.

d) Location information access control mechanism. 1) Mobile smart terminals manage the location information obtained by apps on the mobile smart terminal, provided the app has user authorization. Get location information; 2) Mobile smart terminals provide users with the option to grant apps access to precise location information; users may not allow apps to obtain precise location information. When obtaining location information, the app obtains approximate location information with a certain offset.

e) Mobile smart devices restrict the ability of apps to activate the microphone in the background.

f) Mobile smart terminals restrict the ability of apps to launch the camera in the background.

7.4 App Lifecycle Management

7.4.1 App Installation Management The following management measures are implemented for app downloads and installations on mobile smart terminals.

a) Install the app only after obtaining the user's consent to prevent malicious silent installation without the user's knowledge;

b) Do not grant one-time authorization for permissions to collect personal information requested by the App;

c) Apps that require updates should be managed according to

7.4.2 App Auto-Start and Associated Startup Management Mobile smart terminals provide users with the ability to disable app auto-start and associated startup, preventing unauthorized startup without user consent.

Note. Associated startup refers to the behavior of an application being launched and run without the user's knowledge.

7.4.3 App Uninstallation Management When an app is uninstalled, the mobile smart terminal provides a mechanism to completely delete personal information in the app's private storage directory.