China's regulatory crackdown on data security in the travel sector intensified in June 2026, with Trip.com Group receiving a RMB 10 million (approximately USD 1.48 million) fine for illegal cross-border data transfers. The penalty, announced on June 13, was levied by the Shanghai Cyberspace Administration under China's Personal Information Protection Law (PIPL) for failing to comply with cross-border data transfer security assessment requirements.
The case is part of a broader enforcement campaign by the Cyberspace Administration of China (CAC) targeting internet companies in sectors closely tied to people's lives, including online travel. Regulators have intensified efforts to crack down on violations that endanger cybersecurity and data security, infringe on personal information rights, and disrupt economic and social order.
Regulatory Actions Against Trip.com Group in 2026
This is not the first regulatory action against Trip.com Group this year. In January 2026, China's State Administration for Market Regulation (SAMR) launched an antitrust investigation into the company under the Anti-Monopoly Law over suspected abuse of market dominance. The news triggered a sharp market reaction, wiping more than HK$60 billion (about USD 7.65 billion) off the company's market value within two trading days.
In March, three Beijing government agencies jointly summoned 12 online platforms, publicly criticizing Trip.com's "automatic price-matching" mechanism for undermining hotels' pricing autonomy. This highlighted growing regulatory scrutiny of how online travel platforms interact with hotel partners.
In May, the CAC advanced its nationwide algorithm governance campaign, requiring major online travel platforms, including Trip.com, to conduct self-inspections. Then, on June 11, three government ministries jointly summoned seven train-ticket booking platforms, targeting practices such as "ticket-snatching fees," speculative ticket purchasing, and the improper collection of personal information.
Two days later, on June 13, the data compliance penalty was announced. Under the guidance of the CAC, the Shanghai Cyberspace Administration handled a series of enforcement cases involving local companies that had failed to fulfill their data security responsibilities, lacked adequate security protection measures, had insufficient compliance capabilities in back-end data processing, or conducted inadequate compliance reviews for cross-border data transfers.
Among the cases, Shanghai Trip.com Commerce Co., Ltd. was fined RMB 10 million under the PIPL for illegally transferring personal information overseas. The company was also ordered to rectify the violations within a specified time limit. Following the penalty, the company actively cooperated with regulators and fully implemented the required corrective measures.
For travel industry professionals, this case underscores the increasing importance of data compliance in cross-border operations. As China tightens its data security framework, airlines, hotel groups, and travel technology vendors operating in or with China must ensure robust data protection measures. The travel industry's reliance on cross-border data flows—from booking systems to loyalty programs—makes compliance a critical operational priority.
This regulatory environment is not unique to China. Similar data localization and cross-border transfer requirements are emerging in other jurisdictions, including the European Union's GDPR and India's proposed data protection law. Travel companies with global operations must navigate a complex patchwork of regulations, making investment in compliance infrastructure essential.
For travel agents and tour operators, the fine serves as a reminder to review their own data handling practices, especially when using third-party platforms or processing customer information for international bookings. The case also highlights the need for transparency in how personal data is collected, stored, and transferred across borders.
As the travel industry continues to recover and expand, data security and privacy will remain key regulatory focus areas. Companies that prioritize compliance will be better positioned to avoid penalties and maintain customer trust in an increasingly regulated global market.
