Does Optimizely (Episerver) Work in China? Data Residency, ICP & PIPL

Optimizely — the digital experience platform most teams still know as Episerver — is one of the most widely deployed enterprise DXPs in the world, and “does Optimizely work in China” has a sharper answer than a plain yes or no. Optimizely is not software you install on a server of your choosing; it is a platform Optimizely hosts and runs for you, and it answers the China question in its own documentation: it runs on Microsoft Azure, in a fixed set of regions, with none inside mainland China. A site built on it is reachable from the mainland — but it is served, and its data is stored, from offshore.

So the honest version of the question is not “is Optimizely blocked,” but “where do your Optimizely content and your visitors’ data live, and can the public site in front of them be licensed to operate in China.” Those are two compliance questions — data residency and the ICP filing — and they are the half of “does Optimizely work in China” that no amount of caching, experimentation tuning or edge delivery answers. Below is what Optimizely documents about where it runs, how China’s Personal Information Protection Law treats the data a China-facing site collects, and the ICP filing a public mainland site turns on — in Optimizely’s own words and China’s own law, so you can take the question to counsel rather than to a stopwatch.

Optimizely in China at a glance

What Optimizely (Episerver) is — a managed DXP on offshore Azure

Optimizely’s own Cloud Architecture documentation is the place to start, because it answers the question most “does it work in China” write-ups skip: who runs the servers, and where. Optimizely calls its platform “a managed hosting platform built on Microsoft Azure” — Optimizely provisions and operates it, and you choose a region from a fixed list. The product has history worth naming plainly: it began as Episerver, and after Episerver acquired the experimentation company Optimizely in 2020 it adopted the Optimizely name in 2021, so the CMS/DXP and the experimentation and personalization suite now sit under one brand. What has not changed is the shape of the thing — it is a platform at Optimizely’s addresses, not software you install on a server of your own.

That reframes the whole question. Because Optimizely hosts the platform, “is Optimizely blocked in China” is the wrong lens: it is reachable from the mainland. A site served from offshore can be slow for mainland visitors, and themes or front-end code that pull in third-party fonts, analytics or map libraries can load assets that are themselves degraded inside the mainland — but that is a delivery matter, not what decides whether you may run Optimizely for a Chinese audience. What decides that are the two doors below, and both turn on the fact that every region Optimizely offers sits outside mainland China.

The first door: where your content and your visitors’ data live

For a mainland audience the first door is data residency, and Optimizely settles it in its own words: “Your content database and blob storage remain in your selected region,” and “origin data stays in-region.” The region list runs North America East (Virginia), North America West (Washington), Europe West (Netherlands), Europe North (Ireland), Asia Pacific (Singapore) and Australia East (Sydney) — six regions, none in mainland China, with Singapore the nearest and still offshore. Whatever your Optimizely site keeps therefore lives outside the country.

A DXP rarely just paints pages. Page content, editor and contact records, form and campaign entries, and — because Optimizely’s experimentation and personalization watch on-site behavior — the visitor identifiers tied to that behavior all land in the offshore region you pick. For a visitor in China, those identifiers and submissions are personal information. Keep them in an offshore region and you are carrying that personal information out of the mainland, which China’s Personal Information Protection Law governs as a cross-border transfer (Chapter III, Articles 38–43: notice, separate consent, and one permitted transfer mechanism — a CAC security assessment, the CAC standard contract, or certification). The weight scales with volume and role rather than with using Optimizely at all: under the CAC’s March 2024 cross-border rules, a non-CIIO moving fewer than 100,000 individuals’ non-sensitive personal information in a calendar year is exempt from those mechanisms, while a CIIO or large-volume handler must keep personal information collected in China inside the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). Which of these applies to you is a question for counsel, so treat the specifics as a risk picture rather than a default.

The second door: an ICP filing for the public mainland site

Serving a public website to people in mainland China turns on a permission that has nothing to do with Optimizely’s code: an ICP filing (备案). Under State Council Order No. 292 (Article 4) and MIIT Order No. 33, that filing attaches to a hosting resource physically inside the mainland and to a mainland legal entity — and a platform that runs only in offshore Azure regions has nothing in-country for it to bind to.

This is where “Optimizely Cloud is where our site already lives” settles nothing about China. The platform publishes no mainland-China region, so reaching the site from Singapore or Virginia does not create the in-country footing a filing needs — and that holds whether you render traditional pages or a headless front end against Optimizely’s content APIs. The filing follows the hosting, the hosting is offshore, and closing this door means putting ICP-filed delivery inside the mainland in front of the Optimizely origin, not re-platforming away from it.

Where 21YunBox fits — a compliant overlay, not a migration

You keep Optimizely exactly as you build it today — same CMS, same experimentation and personalization, same content model, same workflow. What a mainland-China audience adds is the one thing the platform’s offshore footprint cannot supply: ICP-filed delivery from inside the mainland, placed in front of your existing Optimizely origin, with a fixed in-country entry so each visitor’s real IP is not carried across the border. Our China team maps which obligations apply to your entity and the personal data your Optimizely site collects, handles the ICP filing, and stands up the in-country entry — and where the law requires your users’ data to stay on Chinese soil, helps you keep that data on the mainland. No rebuild, no second codebase, no move off Optimizely.

Get a compliance assessment →

Related reading:

• What is the China ICP license, and how do you get one?
• Cross-border data transfers under PIPL