DiDi kept collecting data after regulators told it to stop — China fined it $1.2B

China's Cyberspace Administration opened a security review of DiDi in July 2021, days after the ride-hailing company listed on the New York Stock Exchange without first clearing the review it had been told to seek. Regulators pulled its main app from domestic app stores the same week and barred it from registering new users for more than a year while investigators combed its systems.

The review found DiDi had committed 16 categories of violation stretching back to June 2015: it collected 107 million facial-recognition records, 53.5 million age records, 1.4 million records describing riders' family relationships, and 11.96 million screenshots pulled from users' photo albums without a business reason to have any of it. It had also scraped 8.32 billion entries from drivers' and riders' phone clipboards and installed-app lists — data with no bearing on matching a ride.

On 21 July 2022 the regulator fined DiDi ¥8.026 billion (about $1.2 billion) under China's data security and personal information protection laws. The CAC's own statement described the company as having repeatedly evaded supervision rather than correcting course when first warned.