Shopify in China: Reachability, PIPL & ICP for Your Store

For a mainland-China audience, the first thing to know about Shopify is reassuring and misleading at once: your store is reachable. A Shopify storefront on a custom domain generally paints for visitors inside China, checkout included, because Shopify serves every store from its own global network. But reachability is only the delivery half of “does Shopify work in China,” and it is the half that tempts teams to stop looking. The half that decides whether you may lawfully run the store sits one layer down — in where Shopify hosts it, and where your shoppers’ data ends up.

Shopify is a fully hosted platform: it runs your storefront and checkout on infrastructure it owns and operates, with no region inside mainland China. That one fact opens the two doors no amount of theme, app or image work can close — a public store served to the mainland needs an ICP filing bound to a licensed in-country host you do not have, and every customer account, order and checkout record it collects becomes a cross-border transfer of personal data China’s law governs. Below is what Shopify documents about hosting your store, and how China’s rules treat the store and its data — in Shopify’s own words and China’s own law, so you can take it to counsel rather than to a benchmark.

Shopify in China at a glance

Reachable, but served from offshore — which is the whole story

Start with the good news, because it is also the trap. Shopify hosts every store on its own infrastructure and serves it through a global content delivery network — its hosting page says the platform “uses a CDN (Content Delivery Network) with several servers” so that “global website visitors can access your ecommerce store”, and that “Any hosting updates will be done automatically”. For a mainland audience that means the storefront, and the checkout flow with it, generally reach the screen. Nothing is “blocked.”

What that convenience also means is that the host is Shopify’s, and it is offshore. You do not provision or control a server, and Shopify names no datacenter region inside mainland China, so there is no hosting resource of yours in the country. That single geography settles both compliance doors below before performance is ever in the picture — and it is why tuning images, apps or theme code, however worthwhile elsewhere, cannot answer the China question. Reachable is not the same as filable, and it is not the same as compliant.

The first door: an ICP filing for a public store

Serving a public website to people in mainland China turns on a permission that has nothing to do with your Shopify theme: an ICP filing (备案). Under State Council Order No. 292 (Article 4) and MIIT Order No. 33, that filing attaches to a hosting resource physically inside the mainland and to a mainland legal entity. Because your store runs on Shopify’s offshore host, there is nothing in-country for the filing to bind to.

A storefront also raises the bar on which filing. Because a Shopify store takes orders and payment, it is commercial internet information service rather than a brochure site — which points past a basic recordal toward a commercial ICP (an ICP license). “We already run on Shopify” does not carry across the border: reaching China from an offshore host is not the same as being cleared to operate a store there.

The second door: your shoppers’ and orders’ data leave China

A store is not just pages — it is accounts, carts, orders, shipping addresses and checkout records. On Shopify, all of it is handled on Shopify’s infrastructure, which by its own account sits outside the mainland. Shopify’s privacy policy describes it as “a Canadian company, but we work with and process data about individuals across the world,” and states that “we may send your Personal Data outside of your state, province, or country, including to the United States.”

For a China audience that makes data residency the second door. A shopper in China’s account details, order history and payment identifiers are personal information, and moving them offshore is a cross-border transfer China’s Personal Information Protection Law governs (Chapter III, Articles 38–43: notice, separate consent, and one permitted transfer mechanism — a CAC security assessment, the CAC standard contract, or certification). The weight scales with volume and role rather than with using Shopify: under the CAC’s March 2024 cross-border rules, a non-CIIO moving fewer than 100,000 individuals’ non-sensitive personal information in a calendar year is exempt from those mechanisms, while a critical information infrastructure operator or large-volume handler must keep personal information collected in China inside the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). Which of these applies to you is a question for counsel, so treat the specifics as a risk picture rather than a default.

Where 21YunBox fits — a compliant overlay, not a migration

Shopify stays your storefront. It is a strong global commerce platform, and nothing here is a reason to leave it — the gap is jurisdictional, not technical. What an offshore hosted platform cannot hand you is a presence inside the border: compliant, ICP-filed delivery from within mainland China, placed in front of the Shopify store you already run, with a fixed in-country entry so each visitor’s real IP is not carried across the border. Our China team reads your ICP scope and your PIPL cross-border and data-residency exposure against your entity, your order data and who your shoppers are, handles the filing, and stands up the in-country delivery a lawful China storefront needs — while Shopify keeps doing what it does well. No rebuild, no second storefront, no move off Shopify.

Get a compliance assessment →

Related reading:

• What is the China ICP license, and how do you get one?
• Cross-border data transfers under PIPL