Does Adjust Work in China? Data Residency, ICP & Cross-Border Rules

For a company running Adjust to measure a mainland-China app audience, the deciding question is not whether the SDK can reach its servers — it can; Adjust even operates native measurement inside China. The question is what the SDK collects along the way, and where that data is allowed to come to rest. Adjust is a mobile attribution SDK: you embed it in your app, and from that moment it is built to watch installs, sessions and in-app events and to tie each of them to a device — generating its own Adjust Device ID and reading the platform advertising identifiers (Apple’s IDFA and IDFV, Android’s Google Play Services Advertising ID). That is, by design, a continuous stream of your China users’ device identifiers and behavioral events, and Adjust sends it to Adjust’s servers to perform the attribution. So “does Adjust work in China?” is a compliance-risk question first: whose device data is leaving the country, on what consent, and under which of China’s rules on SDKs that collect personal information — not how fast a callback returns.

Adjust in China at a glance

What the SDK actually collects — device identifiers and behavioral events

The trap is to picture an attribution SDK as a thin pipe that only reports a number back to a dashboard. It is the opposite: collecting is its entire job. Adjust’s developer documentation states that “Adjust generates a unique Adjust Device ID (ADID) for each device,” and that the “IDFA (ID for Advertisers) is a device-specific identifier for Apple devices,” alongside the IDFV on Apple and the Google Play Services Advertising ID on Android. The SDK binds those identifiers to the install that produced them, to each subsequent session, and to the in-app events you instrument, then transmits the set to Adjust’s servers so the attribution engine can decide which campaign earned which user. Every one of those records is tied to a real device belonging to a real person in China.

That is why the residency fact matters so much. Adjust’s own Help Center offers data residency for only four regions — the United States, the EEA, Turkey and the Kingdom of Saudi Arabia — and says plainly that “data residency only applies to raw, user-level data.” There is no mainland-China region on that list, so the raw, user-level records the SDK collects from your China audience come to rest on offshore Adjust servers. Adjust’s “native measurement” inside China is a connectivity and measurement capability — it helps events arrive despite network conditions — not an in-country place for the data to live. The device data still leaves the country.

The doors: cross-border transfer, separate consent, and China’s SDK rules

The first door is the cross-border transfer. The device identifiers and behavioral events the SDK collects from people in China are personal information under China’s Personal Information Protection Law, and moving them to an offshore Adjust region is a cross-border transfer (数据出境). The duty lands on you, the app publisher and handler, not on Adjust: Articles 13 and 23 require notice and a lawful basis to collect, with a separate consent to share the data abroad, and Articles 38–40 require a transfer mechanism to send it out — a CAC security assessment, the CAC standard contract, or certification. Where a device identifier or a behavioral profile rises to sensitive personal information, Articles 28–29 add a specific-purpose, necessity and separate-consent test on top. And for a critical information infrastructure operator or a high-volume handler, the Cybersecurity Law’s Article 39 (formerly Article 37 — the 2025 Cybersecurity Law amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39, its substance unchanged) requires personal information generated in China to be stored in the mainland, which an offshore SDK pipeline cannot satisfy.

The second door is consent, and it has a sharp edge that a generic privacy notice does not meet. China’s rules do not accept a single bundled agreement that forces a user to accept all data uses at once (a 一揽子 “take it or leave it” consent). An attribution SDK that collects device identifiers and tracks behavior needs a separate, specific, informed consent for that tracking — obtained before the SDK begins to collect, not inferred from continued use of the app.

The third door is the one that makes an SDK different from an ordinary offshore app, and it is where a reachability check is most blind. China specifically governs the software components that collect personal information. The MIIT and CAC campaigns and rules on apps and third-party SDKs “illegally collecting and using personal information” (App 违法违规收集使用个人信息) require an SDK to declare what it collects and to obtain consent before collecting, and they treat silent over-collection — gathering device identifiers and behavioral data by default, without declaration or consent — as the very harm they exist to stop. An attribution SDK that exfiltrates device data the moment it initializes is squarely the pattern those rules describe. A speed test asking “did the event arrive?” cannot see any of this.

A note on ICP: an attribution SDK buried inside an app is not itself a public internet information service, so the SDK alone does not create an ICP filing (备案) duty. If the same product also exposes a China-facing web surface — a companion site, a web sign-up funnel, a campaign landing page — that surface is a public internet information service and carries its own ICP filing obligation bound to mainland hosting, separate from anything the SDK does.

A reachability check never sees this

Adjust is not the kind of service that refuses to load in China — if anything, the opposite, since it markets measurement that works there. That is exactly why a reachability check is the wrong instrument. Even with every event arriving cleanly, using Adjust still places your China audience’s device identifiers and behavioral data outside the country; it still relies on a consent basis that, for this kind of tracking, China’s law requires to be separate and specific and obtained before collection; and it still runs collecting software of precisely the kind China’s SDK rules single out. A reachability test answers “did the callback return?” — it is blind to whose device data just crossed the border, to whether that person gave the separate consent the law demands, and to whether the collection was ever declared. Where the data lives, on what consent, and whether the collection was declared — not how fast a callback returns — is what China’s law responds to.

This is a risk map, not a verdict that Adjust is “blocked” or “illegal” in China. Which duties bite your case turns on your entity, which apps embed the SDK, what you instrument it to collect, your role under Chinese law, your data volumes, and who your users are — worth settling the specifics with counsel before your China measurement depends on it.

The lawful path — map, localize, deliver

There is a compliant way to run mobile measurement for a China audience, and it sits in front of the Adjust integration your team already ships — no rebuild, no second SDK, no migration off Adjust.

First, map: our China team inventories what your Adjust integration actually collects — the device identifiers, the install, session and event data, the attribution records — where that data is hosted (an offshore Adjust region, with no mainland-China option), and the consent basis each collection point relies on. We build the technical picture; the legal conclusions are settled with counsel.

Then localize/govern: we help you keep the regulated data — your China users’ device identifiers and behavioral events — on a lawful in-country path, obtain the Article 13/23 notice and the separate, specific consent this kind of tracking requires before the SDK collects, and meet the high-volume residency duty where it applies. Localize means keeping the data in-country — never a route that quietly ships device data across the border, and never any form of circumvention.

Then deliver: compliant, in-country delivery in front of what you already run, so the regulated collection and measurement happen on a lawful footing rather than defaulting offshore. 21YunBox stands that up — the 21YunBox Optimizer — around the stack you already use. 21YunBox never uses or suggests circumvention of any kind — we keep in-country what the law says must stay, deliver the rest compliantly from inside the mainland, and never move personal information across the border by stealth. Making an offshore SDK merely reachable is not the answer — the data is still offshore and the separate consent is still missing; keeping the regulated device and attribution data in-country, on a consented and declared path, is. 21YunBox is a compliance overlay and partner to Adjust, not a competitor to it.

Get a compliance assessment →

Related reading:

• Cross-border data transfers under PIPL
• China’s Personal Information Protection Law (PIPL)
• China’s Cybersecurity Law
• How to get an ICP filing for China

RELATED TECHNOLOGIES

AppsFlyer

AppsFlyer

Hootsuite

Hootsuite

Khoros

Khoros

Sprout Social

Sprout Social

TikTok Pixel

TikTok Pixel