Does Adobe Experience Platform Work in China? Data Residency, ICP & Cross-Border Rules
Adobe Experience Platform is Adobe's CDP — it fuses identity and behavior from every channel into one Real-Time Customer Profile, the richest identity graph you hold on your China customers, provisioned only in offshore Adobe regions with no mainland-China option. A compliance-first look at the PIPL cross-border, sensitive-data and Article 24 automated-decisioning doors.
Does Adobe Experience Platform work in China?
Whether Adobe Experience Platform "works" in China is a data-governance question, not a speed test. AEP is Adobe's customer-data platform: it stitches identity and behavior from every channel into one Real-Time Customer Profile per person — the most concentrated identity graph you hold on your China customers — and Adobe provisions that profile only in offshore regions (Virginia, London, Amsterdam, Toronto, Maharashtra or New South Wales), with no mainland-China region.
Holding that unified profile abroad is a cross-border transfer under PIPL (Articles 38–40, on the Article 13/23 notice-and-consent), and where it carries inferred or behavioral traits it can reach sensitive personal information (Articles 28–29). The exposure a reachability check never sees is Article 24: AEP's segmentation, activation and AI scoring make automated decisions about individuals, which China's law requires you to run transparently and let data subjects opt out of — a duty on the profile itself, and one that repeats as the profile fans out to every Experience Cloud app.
This is a risk map, not a verdict — which duties bite turns on your entity, your data and who your customers are. Our China team can map your exposure and the in-country path with you →
What Adobe Experience Platform's own documentation says about China
| Fact | Primary source |
|---|---|
| Adobe provisions Experience Platform only in offshore regions — none in mainland China. Adobe's own hosting-locations documentation states that "Experience Platform is available in six Microsoft Azure hosting locations, one Amazon Web Services (AWS) hosting location" — Virginia, London, Amsterdam, Toronto, Maharashtra and New South Wales — and the region is fixed when your instance is provisioned. There is no mainland-China region in the list, so the unified customer profile is held abroad by default. | Adobe Experience League — Experience Platform hosting locations (multi-cloud), retrieved 2026-10-12 |
| Adobe ties the region choice directly to data residency — and offers no China choice. The same page tells customers that "Choosing the right cloud region is crucial for meeting data residency requirements and ensuring optimal performance," then lists only the offshore US, UK, Netherlands, Canada, India and Australia locations. For China customer data there is no in-country option to choose, so Experience Platform cannot satisfy a mainland data-residency requirement on its own. | Adobe Experience League — Experience Platform hosting locations (multi-cloud), retrieved 2026-10-12 |
| Holding the unified profile offshore is a cross-border transfer, and parts of it can be sensitive. The China customer profile is personal information under China's Personal Information Protection Law; storing it abroad is a cross-border transfer requiring notice and separate consent (Articles 13 and 23) and a transfer mechanism (Articles 38–40). Where the profile carries inferred or behavioral traits it can reach sensitive personal information (Articles 28–29). For a critical information infrastructure operator or a high-volume handler, personal information collected in China must be stored in the mainland (Cybersecurity Law Article 39 (formerly Article 37)). | PIPL Articles 13, 23, 28–29, 38–40; Cybersecurity Law Article 39 (formerly Article 37) |
| Automated segmentation and personalization fall under PIPL Article 24. AEP's audience segmentation, activation and AI-driven scoring make decisions about individuals using their profiles. PIPL Article 24 requires automated decision-making to be transparent and fair, and gives China data subjects the right to an explanation and to opt out of decisions made solely by automated means — a governance duty that attaches to the profile itself, not to how fast the platform loads. | PIPL Article 24 |
Sources verified by the 21YunBox compliance team on 2026-10-12.
For a brand running Adobe Experience Platform to serve a mainland-China audience, the deciding question is not how quickly a personalized experience paints from Shanghai. It is where one specific asset is allowed to live: the unified customer profile. Adobe Experience Platform is Adobe’s customer-data platform — not Adobe Experience Manager, and not the Experience Cloud umbrella — and its whole job is to stitch identity and behavior from every channel (web, app, email, advertising, call center, point of sale) into a single Real-Time Customer Profile per person. For your China customers, that profile is the most concentrated identity graph your brand holds anywhere: who they are, every identifier that resolves to them, and what they have done across all of your touchpoints, collapsed into one record. Adobe provisions that profile only in offshore regions, with no region inside mainland China — so the richest personal data you hold on your China customers rests abroad by default. That makes this a compliance-risk question first, not a performance one.
Adobe Experience Platform in China at a glance
| What decides it | In Adobe's own terms — and China's law |
|---|---|
| What it holds | The unified Real-Time Customer Profile: Adobe's Identity Service stitches every identifier that resolves to a person (login, email, phone, device and cookie IDs, CRM and loyalty keys) to their behavioral event stream across web, app, email, ads and store — one record per China customer, the most concentrated identity graph your brand holds anywhere. |
| Where it runs | Adobe Experience Platform is a cloud-only SaaS. Adobe provisions it in six Microsoft Azure locations — Virginia, London, Amsterdam, Toronto, Maharashtra and New South Wales — and one AWS location in Virginia; the region is fixed when your instance is provisioned, and none is inside mainland China. |
| The unified profile offshore | Held abroad, the China customer profile is personal information resting outside the mainland — a cross-border transfer under PIPL Articles 38–40, on the Article 13/23 notice-and-consent. For a critical information infrastructure operator or a high-volume handler, Cybersecurity Law Article 39 (formerly Article 37) requires China-collected personal information to be stored in the mainland. |
| Behavioral & inferred traits | A CDP profile is not just contact fields — it carries inferred interests, propensity and lifetime-value scores, and fine-grained behavior. Where that tips into sensitive personal information, PIPL Articles 28–29 add a specific-purpose, necessity and separate-consent test. Frame the classification as a risk to confirm with counsel, not a settled label. |
| Automated decisioning | This is the half a speed test never sees. AEP's audience segmentation, activation, edge decisioning and AI scoring make decisions about individuals using their profiles — automated decision-making under PIPL Article 24, which requires transparency and fairness and gives China data subjects an opt-out from decisions made solely by automated means. It is a governance duty on the profile itself. |
| The fan-out | The profile is the backbone of the whole suite: it feeds Real-Time CDP, Journey Optimizer, Customer Journey Analytics and Target. Every app that reads or acts on it is another surface touching your China customers' personal information, so the exposure repeats rather than staying in one place. |
| Reachability is not the axis | Whether the AEP UI or an edge experience loads quickly from the mainland is operational, not the compliance question. What decides it is where the unified profile lives and whether the automated decisions it drives meet China's law. 21YunBox helps you keep the regulated profile in-country, honor the Article 24 opt-out, and deliver any China-facing experience compliantly — the 21YunBox Optimizer — in front of the Adobe stack you already run. |
What AEP actually holds — one unified profile per China customer
Adobe Experience Platform is not a page-rendering tool; it is the data backbone beneath your customer experience, and it concentrates the one thing China’s law cares about most. Its Identity Service resolves the many identifiers a person leaves across your estate — authenticated logins, email and phone, device and cookie IDs, CRM and loyalty keys — into a single identity, then binds that identity to the person’s behavioral event stream from every channel. The result is the Real-Time Customer Profile: for each of your China customers, one record that says who they are and what they have done everywhere you touch them. That is a richer, more revealing asset than any single system of engagement, and — because Adobe provisions the platform only in offshore regions — it is held and processed abroad by default. The exposure a reachability check never sees is not a slow paint; it is this profile, at rest, outside the country.
The doors: profile residency, sensitive inferences, Article 24, and fan-out
The first door is residency of the profile itself. The China customer profile your AEP instance assembles is personal information under China’s Personal Information Protection Law, and holding it in an offshore region is a cross-border transfer (数据出境). The duty lands on you, the handler, not on Adobe: Articles 13 and 23 require notice and a basis to collect the data, and Articles 38–40 require a transfer mechanism to send it abroad — a CAC security assessment, the CAC standard contract, or certification. And for a critical information infrastructure operator or a high-volume handler, the Cybersecurity Law’s Article 39 (formerly Article 37 — the 2025 Cybersecurity Law amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39, with its substance unchanged) requires personal information generated in China to be stored in the mainland, which an offshore instance cannot satisfy.
The second door is what the profile infers. A CDP does not only store the fields a customer hands you; it derives interests, propensity and lifetime-value scores, and resolves fine-grained cross-channel behavior into traits that drive targeting. Where those inferences reveal things like health, finances, or precise location patterns, the profile can carry sensitive personal information, and PIPL Articles 28–29 raise the bar with a specific-purpose, necessity and separate-consent test. Treat the classification as a risk to confirm with counsel rather than a label to claim — the point is that a profile built to be predictive is, by design, closer to sensitive data than a plain contact record.
The third door is the one a reachability check is structurally blind to: automated decision-making. AEP’s audience segmentation, its Real-Time CDP activation, its edge decisioning and its AI-driven scoring all make decisions about individuals using their profiles — exactly the activity PIPL Article 24 governs. Article 24 requires automated decision-making to be transparent and fair, bars unreasonable differential treatment, and gives individuals the right to an explanation and to opt out of decisions made solely by automated means. That is a governance obligation attached to the profile and how you act on it — not something tuning the delivery path can discharge.
The fourth door is the fan-out. The profile is deliberately not siloed: it is the shared backbone that Journey Optimizer, Customer Journey Analytics, Target and the rest of the suite read from and write back to. Each of those apps is another place your China customers’ personal information is processed, so the residency, consent and Article 24 questions repeat across the suite instead of living in one box. And where any of these power a public, China-facing edge experience served to mainland visitors, that public surface also carries the usual ICP filing (备案) duty bound to mainland hosting — a filing that attaches to a licensed in-country resource, never to Adobe’s offshore delivery.
A reachability check never sees the profile
Adobe Experience Platform is not the kind of service whose China risk shows up as a failed page load — the exposure is quieter and more durable than latency. Even if every console and edge experience opened instantly from the mainland, using AEP would still place the unified profile of each China customer, and the automated decisions it drives, outside the country. A reachability test answers “did the response come back?”; it is blind to where the profile comes to rest, who is lawfully allowed to hold it, and whether the segmentation and scoring acting on it meet Article 24. Where the data lives and how it is acted on, not how fast it arrives, is what China’s law responds to.
This is a risk map, not a verdict that Adobe Experience Platform is “blocked” or “illegal” in China. Which duties bite your case turns on your entity, what your profiles actually hold, your role under Chinese law, and who your customers are — worth settling the specifics with counsel before your China customer experience depends on it.
The lawful path — map, localize, deliver
There is a compliant way to run a customer-data platform for a China audience, and it sits in front of the Adobe stack your team already uses — no rebuild, no second platform, no migration off Experience Platform.
First, map: our China team inventories what your AEP instance holds for China customers — the unified profile and its identity graph, the behavioral and inferred traits, the segments and the AI scoring that act on them, and any China-facing experience the suite powers at the edge — establishes where it is provisioned (an offshore Adobe region), and documents the consent, residency and Article 24 basis each flow relies on. We build the technical picture; the legal conclusions are settled with counsel.
Then localize/govern: we help you keep the regulated data — the China customer profile and its sensitive inferences — on a lawful in-country path, obtain the Article 13/23 notice-and-consent, and honor the Article 24 opt-out for automated segmentation and personalization, with in-country storage where a critical-infrastructure or high-volume duty applies. Localize means keeping the profile on an in-country path — never a route that ships it offshore anyway.
Then deliver: any public China-facing experience the platform powers is an internet information service, so it carries an ICP filing duty bound to mainland hosting and needs compliant, in-country delivery. 21YunBox stands that up — the 21YunBox Optimizer — in front of what you already run, so it serves your users in China legally and compliantly. 21YunBox never uses or suggests circumvention of any kind — we keep in-country what the law says must stay, deliver the rest compliantly from inside the mainland, and never move personal information across the border by stealth. Making an offshore platform merely reachable is not the answer; keeping the China profile in-country, governing the Article 24 path and ICP-filing any public experience is. 21YunBox is a compliance overlay and partner to the Adobe stack you already run, not a competitor to it.
Related reading:
- China’s Personal Information Protection Law (PIPL)
- Cross-border data transfers under PIPL
- China’s Cybersecurity Law
- How to get an ICP filing for China
