First-order effects

• Cheaply sold face data turns every Chinese citizen enrolled in a recognition system into a potential fraud target, since biometric identifiers cannot be reissued the way a leaked password can.
• Retailers and institutions running these systems — the same sector flagged for privacy concerns as far back as 2015's shoplifter-tracking rollout — now bear direct liability for breaches that feed the underground market.

Second-order effects

• Public tolerance is fraying: a state TV special on invasive practices by two retail chains later sparked visible pushback against facial recognition in China, suggesting the breach-and-sale cycle is eroding the social license deployments depend on.
• The pattern forced a regulatory response — new data security rules — but reporting shows they are unevenly enforced, leaving the underground market for stolen personal data thriving despite the formal framework.

Third-order effects

• If enforcement gaps persist, China's biometric infrastructure risks consolidating around a permanent gray market where collected identity data is effectively a tradable commodity, undermining trust in every downstream service built on it.
• The gap between ambitious data security legislation and patchy execution points toward a structural test for state-led AI governance: rules that exist on paper but fail at the database level may push regulators toward harsher, more centralized enforcement.