Online data theft is rife in China, affecting more than 80% of Internet users, and tech companies often display a cavalier attitude to using people’s personal information. But things may change. In May, the government implemented new data protection rules called the Personal Information Security Specification, which was hailed by some analysts as a watershed for data privacy, with a few even comparing it to the European Union’s game-changing General Data Protection Regulation law. While there are important differences between the two, Beijing’s new rules appear to reflect a wider shift in the way the Chinese government, companies and consumers perceive online privacy.