The U.S. government’s recent executive actions against Chinese tech giants TikTok and Tencent, compelling them to either sell their U.S. assets or cease operations in American markets, may prove a watershed moment for international standards and norms towards data privacy and censorship. Emboldened by its vanguard unicorn tech companies and growing influence in developing countries, China is seeking to export its model of “cyber sovereignty” — in which countries set their own rules towards the digital economy and control the Internet purveyed within their borders. These efforts face pushback from the West and especially the U.S., which advocates for the free flow of data. The concern is that China could extend its own “cyber sovereignty” regime past its borders, exerting their economic might for political purposes. Although this threat is more imagined than real as of yet, the U.S.’ bold action against Chinese companies utilizes questionable rationale and arguably mirrors opaque measures China itself employs to prevent foreign tech companies from operating domestically. Through these recent actions, the global digital economy may be on the course for a turbulent decoupling, solidifying the reach and influence of China’s cyber sovereignty model within its own sphere — while at the same time setting up a battle for countries stuck in the middle of disparate data regimes.

A Large Pond

Long before the Trump Administration’s recent actions seeking to exclude Chinese tech companies from American markets, China has been exploiting the leeway offered by exemptions through WTO agreements in regards to censorship to create non-tariff forms of trade barriers for foreign companies. The “Great Firewall” of China’s Internet famously controls whatever digital information flows from outside China’s borders into the vast country. China’s laws make tech firms liable for the information users disseminate on their platforms, rendering self-censorship a prerequisite for any company seeking to operate within China’s borders. Couched in broad language and opaque enforcement mechanisms, China’s censorship regime makes it exceedingly difficult for foreign tech companies to operate within its borders, with most notable names banned outright, including Google, Facebook, Amazon, Twitch, Dropbox, YouTube, and Reddit.

China’s censorship stretches across multiple agencies and utilizes vague codified language to create an uncertain terrain for companies seeking to enter its market. As the censorship regime tightens its screws each passing year, the barriers to entry continue to increase, leaving only the most capable and ambitious tech companies able and willing to operate under China’s terms. Foreign companies like LinkedIn and Apple are only able to operate there by consenting to participate in China’s censorship regime. Corporate responsibility for public censorship obviously isn’t exclusive to foreign firms — Chinese giants Baidu and Tencent likely play the largest role enforcing censorship within China’s borders of anyone — but the regime’s aversion to outside information makes operating internationally within China tenuous and costly for foreign tech firms. China has sought to eliminate the proliferation of virtual private networks (VPN) within its own borders that could sidestep China’s censorship controls. Many foreign firms using VPNs in China have found their connections disrupted by Chinese authorities, which have enacted legislation forcing firms to buy and use expensive licensed VPN services that create “a very narrow and controlled lane for business-specific connection” while restricting their use for broader dissemination.

However, by greatly restricting the information available inside its borders, China’s government puts its own citizens and companies at a disadvantage. The exceptions China’s censors have made, like allowing Chinese government officials to use Twitter or enabling researchers to access academic literature, highlight the pitfalls of restricting the free flow of information at a time of globalized, accelerated innovation . By disengaging its general citizenry from much of the outside informational world, the regime constricts China’s potential talent pool of 1.4 billion people down to a few preselected actors. When GitHub, the largest public code repository in the world, was blocked in 2013, a backlash quickly ensued, as such a move would put programmers in China at a stark disadvantage. The regime relented, though GitHub’s standing remains fragile as it continues to be a platform for sharing anti-censorship software tools within China.

In response to pressure from China, GitHub’s parent company, Microsoft, is looking to open a subsidiary in China, which would create greater uncertainty for the firm but also enable a core aspect of the Chinese model for data control: data localization, which requires data within a country to be collected, processed and stored within local servers. While a potential tool to prevent foreign spying, data localization is used by countries like China, Russia, Turkey and Vietnam to silo digital data flows and monitor or censor information. Tech companies operating within China must have all pertinent data kept in local servers, and operating foreign firms like Airbnb, LinkedIn, and Apple have subsequently complied.

The numerous barriers into China’s market produced fertile grounds for what today are known as China’s unicorns to expand and flourish. With support from the Chinese government and a local population of 1.4 billion people, even with the aforementioned informational barriers to the outside world, the domestic market was sufficient for companies like Alibaba and Tencent to become world-class tech powerhouses through expansive functionality and an enormous population to serve — with relatively little competition from Western tech firms.

Innovation Runneth Over

China’s rise as a formidable mobile payments and ecommerce powerhouse pushing advanced functionality and the unprecedented convenience of its superapps beckoned for its operations to expand outwards — and to fearful Western observers, possibly its corresponding data collection and censorship regime as well. But although these companies grew by leaps and bounds within a relatively constrained environment, the story is a bit messier looking outwards.

Generally speaking, Chinese tech firms specializing in communication or social media have not expanded their reach much beyond their home turf, with TikTok being the notable exception. Considering the constrained informational ecosystem they grew up in, this is unsurprising. A company like Baidu, China’s primary search engine, makes little sense in countries with access to Google where free-flowing information is the norm. And for many data-driven Chinese companies, there can be little incentive to expand beyond China's vast customer base. It would require revamping operations to adhere to privacy-conscious data regimes elsewhere in the world.

“Because the domestic market is so huge, Chinese companies objectively don’t really need to move to the market beyond China. [Besides TikTok], I’ve personally not seen many Chinese apps try to get into the international market as their priority. I think the cost benefit analysis could lead you to conclude it may not be worthwhile to pursue. They are more focused on developing advanced features for Chinese people and serving that part of the market.”

Ting Li, Professor of Digital Business, Rotterdam School of Management

Aside from TikTok, the most ambitiously outward-looking Chinese tech firm is Alibaba. The company currently generates less than 10% of its revenues internationally, though it seeks to ramp that up to 40% by 2027. Admittedly, Alibaba’s business model is more suited than others in traversing diverse data regimes. Alibaba’s prized ecommerce operations, Taobao —the largest ecommerce operation in the world — runs into less pushback from regions wary of insidious data collection practices. Equipped with the advantage of low costs for customers, Alibaba’s ecommerce operations have pushed into Southeast Asia and Latin America, buttressed by measured investments in foreign markets like the Southeast Asian ecommerce firm Lazada. But among its wide array of offerings, Alibaba’s greatest potential to extend its grip to all reaches of the globe might be its fintech arm, Ant Group, which oversees its mobile payments platform, Alipay. Taobao and Ant Group are seamless fits for developing countries in places like Africa, where Alibaba CEO Jack Ma has focused his energies through initiatives like the EWTP, which seeks to foster global e-trade rules through public-private partnerships. Though its entry into Western markets is limited by the preeminence of credit cards and other fintech operations, Alipay’s incursion into other markets is simplified by financial rules they can abide by without running into as many data protection issues. As Mondato recently detailed, Ant Group, with an IPO valuation of up to $200 billion, has partnered with local financial services firms across Asia and now into Europe and Africa to globalize its mobile payments system. Ant Group is deploying Alipay’s integrated service operations to replicate its superapp model in places like South Africa, exporting China’s fintech model to an unprecedented degree.

But Alibaba has certainly taken cues from its origins in a censorship-heavy regime when strategizing its outward expanse. Already, Alibaba has more than 22 data centers overseas as a part of its Alicloud features, often partnering with local data center operators to adhere to data localization regulations in countries less amenable to free flowing data — thus venturing to areas Western companies may be less prepared or inclined to enter. This, combined with Alibaba’s efforts to craft a global payments system through Ant Group’s Alipay is where the company’s greatest international niche might be: offering ecommerce and integrated mobile payment options to customers hailing from countries keen to China’s cyber sovereignty approach, or otherwise indifferent or tolerant when engaged in Taobao’s physical commerce. On a more general level, the physical exchange of goods has always been China’s focus in establishing international standards and norms; its laissez-faire approach to physical commerce faces fewer issues than its insular data regime does in democratically-minded regimes.

The international ventures of Chinese tech firms like Alibaba are being broadly grouped under the loosely defined “Digital Silk Road” initiative, first outlined by a Chinese government white paper in 2015 as the digital arm of the Belt and Road Initiative . By laying down fiber optic cables elsewhere and improving countries’ digital infrastructure, Chinese companies push further in advancing their approach towards data collection and censorship, making inroads in regions like Central Asia and Africa. China has already signed more than 85 standardization agreements with 49 countries and regions. But most often, it’s less a matter of China exerting its influence with these countries through economic means than finding like-minded partners.

“Lots of countries in [the Belt and Road Initiative], they don’t care about free flow of information. They don’t care about censorship. In fact, they welcome censorship. So it’s not a problem for them.”

Henry Gao, Professor of Law, Singapore Management University

That is not to say China’s tech firms will be welcomed by all like-minded regimes. The clearest example is India, whose data protection bill crucially allows the government to exempt itself and has blocked thousands of websites. As relations between China and India deteriorate, the Modi regime has banned dozens of Chinese apps in the purported name of national security.

When In Doubt

However, India only took such actions once the U.S. started signaling its own move towards banning TikTok and WeChat. While stronger arguments could be made in favor of the U.S.’ previous efforts to keep Huawei out of building the 5G networks in the West — which could have made such networks prone to actual hacking or spying of critical national infrastructure — the threats posed by TikTok and WeChat are comparatively less acute and without substantiation. Chinese social media and communication apps can extend China’s censorship apparatus extraterritorially, and in some cases bolster its data collection apparatus. Just recently, ByteDance, TikTok’s parent company, was found to have censored anti-China content in its Indonesian news app. WeChat applies much of the same censorship policies abroad as it does domestically, even down to the individual level.

Looking at the issue in reverse, foreign companies operating in China do have some, if limited, discretion when facilitating cross-border communication. After Zoom acceded to last-minute Chinese requests to block a virtual meeting between Chinese activists at home and abroad by ending the meeting altogether, the company changed its policies to “not allow requests from the Chinese government to impact anyone outside of mainland China,” developing technology to remove individual participants based inside China’s borders.

Yet “national security”, not censorship, was the reason given for the U.S.’ action against TikTok and Tencent. If the U.S. had a national data protection law like the E.U. has in the GDPR, then it could reasonably require TikTok and Tencent to conform to similar data protection laws. As Nigel Cory, Associate Director of Trade Policy at the Information Technology and Innovation Foundation, points out, TikTok nonetheless insists its U.S. operations remain separate from its Chinese infrastructure and its servers are localized to the states — akin to what firms like Zoom, Microsoft and Apple do in China to operate there. Regardless, the U.S. has reverted to mirroring China’s same rationale of national security to block foreign apps, risking grave consequences by doing so.

“Using unspecified national security concerns to take apparently arbitrary actions against apps simply because they’re owned by Chinese tech firms risk the open global digital economy which the United States helped build, and from which its tech sector thrives on. It sets a worrying precedent that other countries will no doubt follow in using these vague concerns to block out apps which they don’t like.”

Nigel Cory, Associate Director, Trade Policy, Information Technology and Innovation Foundation

As India’s decision to ban TikTok and other Chinese apps shows, even before the legally questionable executive orders are carried out, the ramifications are beginning to be felt. While experiencing some limited success in places like India and Malaysia, WeChat’s international reach primarily extends to Chinese nationals abroad who utilize it as one of the only avenues they have to contact relatives back home on the other side of the Great Firewall. The estimated 1.5 million to 20 million WeChat users in the U.S. — only a tiny portion of its 1.2 billion users overall — view the app as a critical source for cross-cultural communication. It’s also a key avenue for American firms like Nike and Walmart to advertise and connect with Chinese customers via ecommerce features. If WeChat is removed from the Apple Store, it would be disastrous to Apple’s booming Chinese business of over 3 million iPhones sold per month; a survey of more than 1.2 million Chinese revealed 95% of them would switch from Apple if they couldn’t access WeChat anymore.

Consequently, a “splinternet,” as Gao frames it, is developing along the lines of data flow norms and standards. As he points out, even the E.U.’s strict consumer data protection model can serve as a barrier to entry to American companies that liberally collect data. Indeed, the European Court of Justice in July invalidated the E.U.-U.S. Privacy Shield, limiting the flow of data from the E.U. to the U.S. — where many tech companies predicate their financial model on accumulating massive user data. These respective barriers to entry among parties will deepen the digital economy’s split further.

“You will see the Internet fragment, maybe an American system focused on free flow of data, a European system focused on privacy protection, and a Chinese system focused on sovereignty.”

Henry Gao, Professor of Law, Singapore Management University

The Clock Is Tiking

While the West’s approach may have more adherents, China is winning in the sense that no international consensus has been reached through the WTO or other multilateral organizations on the issues of cross-border data flows, an area China has long avoided addressing in international agreements but which the U.S. emphasizes in free trade agreements. With the status quo unchanged, so-called “cyber sovereignty” becomes the international default, even if democratically-aligned countries operate their data protection rules differently than localization laws in authoritarian-minded countries.

If no consensus on cross-border data flows is reached in the near future — a likely scenario considering the wide gaps between digital powers — then a scramble is bound to ensue in regions like Africa, the Middle East, and South America, where nations are still figuring out their digital destinies in either accepting attractive investment from Chinese firms or incorporation into the West’s open digital market.

"The battle as we see it are the many countries in the middle — do they take the political and economic benefits they see in the China approach and go from there, or do they look to the E.U., its precautionary approach to data privacy and protection which values consumer protection over innovation and development? Or do you have something like the Singapore and Southeast Asia approach which is much more innovation friendly while still having data privacy and data protection?”

Nigel Cory, Associate Director, Trade Policy, Information Technology and Innovation Foundation

The resulting terrain for tech companies will be uneven. Issues surrounding data flows inevitably give way to geopolitical considerations; as Ting Li points out, TikTok and WeChat’s data collection practices in the U.S. are no different than any other social media company operating there — the issue stems not from them skirting U.S. law, but their murky ties to the Chinese government. However, there is little that tech companies can do other than navigate the dramatically different data flow regimes proceeding from one country to the next. In adapting their data practices to countries variously promoting censorship, data localization, consumer privacy and free-flowing innovation, the challenge is akin to completing a high-priced digital triathlon.

Image courtesy of William Christen
Click here to subscribe and receive a weekly Mondato Insight directly to your inbox.