Executive SummaryOn 1 June 2026, the State Administration for Market Regulation (SAMR) and the Standardization Administration of China (SAC) released a revised draft of the Personal Information Security Specification (the Draft Specification), which is intended to replace the current GB/T 35273-2020 standard. Some recent cases demonstrate that Chinese authorities now regard cross-border data compliance as a mature enforcement priority rather than a transition issue. Under the Draft Specification, such marketing use must be supported by standalone consent obtained independently of the underlying transaction. Article 8.1(a) of the Draft Specification reinforces this requirement by requiring renewed notice and fresh consent where the purpose of the processing changes. Companies that continue to treat China data compliance merely as an extension of their global privacy programs may find that approach increasingly difficult to sustain.