This article aims to examine the actual severity of criminal sanctions on identity theft imposed by Shanghai courts, which entails an analysis of the effects of eight factors on the probability of imprisonment, probation and the length of imprisonment/detention in 507 Shanghai courts' judgements. Since the Supreme People's Court promulgated the Judicial Interpretation on sanctioning identity theft crimes in 2017, the severity of criminal punishment substantially increased. Judges seemed to have considerable discretion to deviate from the sentencing criteria set by the Criminal Code and the 2017 Judicial Interpretation. Judges' discretion indicates a gap between formal criminal law and its enforcement. A more coordinated legal framework of personal information protection that contains criminal law, administrative law and civil law might be more effective in fighting identity theft. It could be meaningful to adjust the existing sentencing criteria and give judges full play to explore the sensitiveness of personal information.