China

If Sollar operates a mini app store in mainland China, a second and entirely separate regulatory perimeter applies. This page describes what is known and marks what is not.

ICP filing covers mini programs

Since September 2023, the MIIT’s ICP filing requirement (备案) applies to mobile applications and mini programs, not only to websites. Tencent enforces it inside its own developer portal for WeChat mini programs, and any comparable platform operating in the mainland faces the same requirement.

Each mini app needs its own filing. It is not covered by the host’s.

Reported timeline

Stage	Reported duration
Platform review	1–2 days
SMS verification	24 hours
Provincial telecommunications bureau	1–20 days

The provincial bureau’s step is the one that matters for planning. It sits on the developer’s critical path, it is outside anyone’s control, and its range is wide enough that a release date cannot be committed until it clears.

Plan filing as a precondition of the project, not a step before launch.

What a filing requires

A registered mainland business entity, a responsible person with a mainland identity document, a domain filed to that entity, and hosting inside the mainland. A foreign company without a mainland entity cannot file, which makes the entity question a prerequisite rather than a detail.

Content and data obligations

Beyond filing, mainland operation brings obligations that are not documentation footnotes:

• PIPL — the Personal Information Protection Law governs collection, consent, and cross-border transfer of personal information. Moving personal data out of the mainland has its own approval regime.
• Data localisation for several categories.
• Real-name verification requirements for certain service categories.
• Content review obligations that fall on the platform operator, meaning Sollar, for everything its mini apps publish.

Sensitive categories — health, finance, education, news, mapping — each carry their own licensing.

Open, and material

Caution

Keycloak inside mainland China is unconfirmed. Sollar’s identity layer depends on Keycloak, and whether it can operate compliantly inside the mainland, under PIPL and behind the national firewall, has not been established. This is an inherited infrastructure risk, and it is not small: if it does not hold, the identity architecture in the mainland is a different design, not a configuration change.

Also open:

• Whether Sollar would operate the mainland store itself or through a licensed local partner. The answer changes who holds the filing, who carries the content-review obligation, and who is liable.
• How the mainland catalogue relates to the international one. Two catalogues, two review queues and two sets of accepted categories is the likely answer, and it doubles the operational surface.
• Whether cross-border identity — an employee of a multinational using the same Sollar account in Shanghai and in Frankfurt — is achievable under PIPL’s transfer rules.

What this means today

Nothing in Sollar’s mini app specification assumes mainland operation, and nothing in it prevents mainland operation. The package format, the manifest, the bridge and the review model are jurisdiction-neutral.

What is not jurisdiction-neutral is the identity layer, the hosting, and the store operation. Those are open questions with commercial and legal answers, not technical ones, and they are recorded here as open rather than resolved by assumption.

If you are building for a mainland tenant

Practical advice, given the above:

1. Start the filing before you start the code. The provincial step will not compress.
2. Assume data localisation. Design your backend so the mainland deployment is a separate instance with its own data, not a region flag on a global one.
3. Do not design around cross-border identity until the transfer question is answered.
4. Expect a separate review queue with different accepted categories.