Does AdTrace Work in China? Attribution SDK, Device IDs, PIPL & Data Residency
AdTrace is a mobile attribution SDK you embed in your app — it collects each user's device identifiers and in-app events and sends them to AdTrace's offshore servers, where its own docs cite GDPR and CCPA but name no China/PIPL path and no mainland-China data region. For mainland China that is a PIPL cross-border transfer and a data-residency question. A compliance-first look.
Does AdTrace work in China?
Whether you can use AdTrace in China is first a cross-border-data and data-residency question, not a speed one. AdTrace is a mobile attribution SDK you embed in your app, and it works by collecting each user's device identifiers and in-app behavior — so the moment it runs for a mainland user, you are handling that person's personal data and shipping it to AdTrace.
In AdTrace's own documentation it is "a mobile attribution and analytics platform" that is "known for its commitment to user privacy, adhering to global data protection regulations like GDPR and CCPA" — naming Europe and California, not China or PIPL, and documenting no mainland-China data region. So the device IDs and event data AdTrace collects from your China users are sent to its offshore servers: a cross-border transfer of personal information that PIPL governs, needing notice, separate consent, a transfer mechanism, and — for a CIIO or large-volume handler — in-country storage. The table below is AdTrace's own wording and the rules it triggers.
This is a risk picture, not a verdict — your obligations turn on your data volumes and your users. Our China team can map your AdTrace exposure with you →
Compliance snapshot
- ! Embeds an SDK in your app that collects each mainland user's device identifiers and in-app events — install source, first open, registration, add-to-cart, purchase
- ! AdTrace's own docs cite alignment to GDPR and CCPA — naming Europe and California, not China or PIPL
- ! Those device IDs and events are sent to AdTrace's offshore servers — a PIPL cross-border transfer (notice + separate consent)
- ✕ No mainland-China data region documented; AdTrace is an offshore attribution platform, so your China users' data has no compliant place to land on its own
- ✓ A compliant in-country collection and storage path exists — no app rebuild, no migration
What AdTrace's own documentation says about China
| Fact | Primary source |
|---|---|
In AdTrace's own words, it is "a mobile attribution and analytics platform." You embed its SDK in your iOS or Android app, it assigns each device an AdTrace identifier (its adid), and from then on it records the user's install source and in-app events — first open, registration, add-to-cart, purchase — with the revenue, retention and lifetime-value data attribution exists to measure. A persistent per-device identifier joined to a log of what a person does in your app is personal information under Chinese law. | AdTrace developer documentation — Introduction, retrieved 2026-10-07 |
| AdTrace points its privacy commitment at Europe and California — not China. Its own documentation says AdTrace is "known for its commitment to user privacy, adhering to global data protection regulations like GDPR and CCPA." Those are the EU and California regimes; China's PIPL is named nowhere in that commitment. [Inference: AdTrace documents no data region inside mainland China, and its product site and legal terms are published in Persian — a non-China-facing operator — so your mainland users' attribution data is handled offshore.] | AdTrace developer documentation — Introduction, retrieved 2026-10-07 |
| Sending that data offshore is a cross-border transfer under PIPL. Device identifiers and in-app behavioral events captured from mainland users are personal information, and exporting them to AdTrace's servers abroad is a cross-border transfer governed by PIPL: the personal-information handler — you, AdTrace's customer, not AdTrace — must give notice, obtain separate consent, and satisfy one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification). | PIPL Chapter III, Articles 38–43 |
| The exposure scales with volume and role. Since the CAC's March 2024 cross-border rules, a non-CIIO transferring fewer than 100,000 individuals' non-sensitive personal information in a calendar year is exempt from the security assessment, standard contract and certification. But for a CIIO or large-volume handler, personal information collected in China must be stored inside the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — and because AdTrace documents no mainland region, the only way to keep that data on Chinese soil is to run the collection and storage on infrastructure inside the mainland. | CAC — Regulations on Promoting and Regulating Cross-border Data Flows, March 2024; PIPL Article 40; CSL Article 39 (formerly Article 37) |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the deciding question about AdTrace is not how quickly its dashboards fill in — it is whose data has to leave the country for them to exist. AdTrace is a mobile attribution and analytics SDK: you embed it in your iOS or Android app, and it works by tagging each device and recording what its owner does — which campaign drove the install, when they first opened the app, what they bought. Point that SDK at your mainland users and you are collecting their device identifiers and in-app behavior and sending it to AdTrace’s own servers. Whether those servers answer quickly on a given day is a delivery detail; where the data lands, and under whose law it then sits, is the exposure.
AdTrace in China at a glance
| What decides it | In AdTrace's own terms |
|---|---|
| What it collects | AdTrace's SDK assigns each device an identifier it calls the adid and records the install source plus post-install events — first open, registration, add-to-cart, purchase — along with revenue, retention and lifetime value. All tied to a device; all personal information under Chinese law. |
| Where it's aligned | AdTrace's own docs say it is “known for its commitment to user privacy, adhering to global data protection regulations like GDPR and CCPA.” It names Europe and California — not China, and not PIPL. |
| Where the data sits | AdTrace documents no data region inside mainland China, and its product site and legal terms are published in Persian. So your China users' attribution data is handled on AdTrace's servers offshore. |
| Who the handler is | The SDK runs inside your app, so the party exporting that personal data abroad is you — AdTrace's customer — not AdTrace. PIPL's duties land on you. |
| The residency rule | Exporting China users' device IDs and in-app events is a cross-border transfer under PIPL (notice, separate consent, a transfer mechanism); a CIIO or large-volume handler must store it in the mainland — which an offshore attribution platform cannot do. |
A device ID and an event log are personal data — and AdTrace collects both
AdTrace doesn’t need you to hand it a name or an email to single out a person; the identifier is the point. Its SDK assigns every device an AdTrace identifier — the adid it generates per device — and from then on it records that device’s journey: the campaign that drove the install, the first open, and the in-app events you choose to measure, from registration to add-to-cart to purchase, along with the revenue and retention that attribution exists to report. A persistent per-device identifier joined to a log of what a person does inside your app is personal information under China’s law. So the instant AdTrace runs for a mainland user, you are handling that user’s personal data — and handling it by sending it to AdTrace.
AdTrace aligns itself to Europe and California, not to China
AdTrace is explicit about the privacy regimes it builds for. Its own developer documentation calls the product “a mobile attribution and analytics platform” and says AdTrace is “known for its commitment to user privacy, adhering to global data protection regulations like GDPR and CCPA.” Those are the European and Californian regimes. China’s Personal Information Protection Law appears nowhere in that commitment, and AdTrace documents no data region inside the mainland; its product site and legal terms are published only in Persian — the marks of an operator oriented away from China. So for your Chinese users, PIPL’s duties are not something AdTrace discharges on your behalf: the requirement to give notice, obtain separate consent for sending personal information abroad, and satisfy a transfer mechanism all land on you, the app owner — alongside any in-country storage obligation. The tool is engineered to satisfy two regimes; the Chinese one it leaves to you.
Reachable or not, the data still leaves the mainland
Because AdTrace lives inside your app rather than in a browser tab, the usual “is it blocked” question misses the mark. The SDK gathers a mainland user’s device ID and events on the device and batches them to AdTrace’s endpoints; whether those endpoints answer cleanly from a given Chinese network on a given day is a delivery question, and not the one that decides whether you may use AdTrace. Even on the connections where every call completes, the calls complete in order to carry your users’ attribution data offshore — a steadier path would export that data more reliably, not make the export lawful. Under PIPL, sending mainland users’ device identifiers and behavioral events to servers abroad is a cross-border transfer requiring notice, separate consent and one statutory transfer mechanism; and for a critical information infrastructure operator or a large-volume handler, personal information collected in China must stay on the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty an offshore attribution platform cannot meet, and one no setting inside the SDK changes. The half that settles whether AdTrace is usable for China is the legal one — where the device and event data is held and under whose jurisdiction — not the network one.
This is a risk map, not a verdict: whether you owe notice, separate consent, a transfer mechanism, in-country storage, or all of them turns on what AdTrace collects for you, how many people it covers, and who your users are — worth settling with counsel before you rely on it.
Where 21YunBox fits — a compliant overlay, not a migration
You keep running AdTrace exactly as you do now — the same SDK in the same app. What we add is the piece AdTrace leaves to you: ICP-filed, in-country delivery placed in front of your existing origin inside mainland China — no rebuild, no second codebase, no move off your current attribution tooling. Our China team traces where your mainland users’ device and event data travels today, weighs your PIPL cross-border and data-residency duties against your entity and your data volumes, and builds the lawful, in-mainland foundation a compliant China presence needs — while AdTrace and the rest of your stack keep running where they already are.
Related reading:
Frequently Asked Questions
Does AdTrace store Chinese users' data in China?
No mainland-China data region is documented. AdTrace's English documentation cites alignment to GDPR and CCPA, not China's PIPL, and its product site and legal terms are published in Persian — an offshore operator. The device identifiers and in-app events its SDK captures from your mainland users are therefore handled on AdTrace's servers outside the mainland.
Is it against the law to use AdTrace in China?
Not inherently. The issue is the cross-border transfer of personal information — device identifiers and behavioral events are personal information under Chinese law — which PIPL permits if you give notice, obtain separate consent and meet one transfer mechanism. Whether you also face a data-localization duty depends on your role (for example, whether you are a CIIO) and the volume of personal information you handle. Treat it as a risk to assess with counsel, not a blanket prohibition.
Can 21YunBox help make our AdTrace setup compliant in China?
Yes. Our China team can assess your cross-border and data-residency exposure for your data volumes and users, and stand up the compliant, ICP-filed in-country delivery — and, where the law requires your China users' attribution data to stay on the mainland, in-country collection and storage — around the app and stack you already run. Get in touch to work through your specific case.
