Starting May 1, apps in China can no longer force users into providing excessive personal data, according to a document jointly released by a group of the country’s top regulators (the Cyberspace Administration, the Ministry of Industry and Information Technology, the Ministry of Public Security and the State Administration for Market Regulation).

It’s a common practice in China where apps ask users to provide sensitive personal information and those who decline to share are often denied access. While some of the requests are justifiable, such as one’s location information to use a navigation map, many others are unnecessary, such as one’s biometrics to make mobile payments.

In December, Chinese authorities laid out the acceptable range of data that 39 common app types are entitled to collect, as TechCrunch reported.

All forms of apps are subject to the requirements, including the increasingly popular “mini programs,” which are lite apps accessed through an all-encompassing native app such as WeChat and Alipay without the need for an app store install, said the new document.

“Extraneous data is most often used for advertising purposes, such as serving up localized ads or ads based on the user’s interests,” said Todd Kuhns, marketing manager at AppInChina, a firm that helps overseas apps distribute in China. “Developers could still request this additional info, but users who refuse will probably still get ads and offers — just less relevant ones.”

For now, the document appears to be a guideline at best as it does not specify how the rules should be enforced and how offenders will be punished. While it marks China’s incremental progress on data protection, regulators will have to keep updating the rules as people’s daily lives are becoming more linked to digital devices at a rapid rate.

In recent months, China has been clamping down on the technological darlings that it used to pride itself on. It introduced a sweeping antitrust law to rein in its “platform economy” and slammed anti-competition fines on Alibaba and Tencent, following Ant Group’s IPO fiasco.