Does Cookie Information Work in China? GDPR Consent, PIPL & Data Residency
Cookie Information is a Danish GDPR consent platform that hosts its data in the Netherlands and serves its banner from offshore — so for mainland China the tool bought to prove compliance can itself be the exposure: the consent records it captures leave the country under PIPL, and a GDPR banner is not a PIPL posture. A compliance-first look at the two doors.
Does Cookie Information work in China?
The irony is the whole answer: Cookie Information is a consent platform you buy to prove you comply — yet aimed at mainland China as-is, the tool itself can become the exposure. Reaching the banner isn't the hard part; which law it answers to, and where it keeps your Chinese visitors' consent records, are.
By Cookie Information's own homepage the platform is "EU-headquartered in Copenhagen," with "data hosted in the Netherlands" and "audit-ready consent records on EU servers." So every consent choice, cookie-scan result and visitor identifier it captures from a Chinese user is personal information that leaves the mainland — a cross-border transfer PIPL governs (notice, separate consent and a transfer mechanism, Articles 38–43), with an in-country storage duty for a CIIO or large-volume handler (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). And because the banner is engineered to GDPR instruments — Google Consent Mode v2, IAB TCF v2.2 — it answers a different regime than PIPL. The table below is Cookie Information's own wording and the rule each line triggers.
This is a risk map, not a verdict — what you owe turns on your role as handler, your data volumes and who your users are, and it's worth settling with counsel. Our China team can map your exposure with you →
What Cookie Information's own documentation says about China
| Fact | Primary source |
|---|---|
| Cookie Information keeps your consent data offshore — and says so on its own homepage. It describes itself as "EU-headquartered in Copenhagen" with "data hosted in the Netherlands," keeping "audit-ready consent records on EU servers." For a consent and privacy platform that is the point in reverse: the record proving a Chinese visitor consented is itself personal information held outside the mainland — a cross-border transfer of personal information under PIPL (notice, separate consent and a transfer mechanism, Articles 38–43). | Cookie Information — homepage, retrieved 2026-10-07 |
The consent banner is delivered from an offshore CDN. The embed on Cookie Information's own site loads its consent script from its app CDN outside the mainland — policy.app.cookieinformation.com. Served from outside China, that gate can load slowly or fail from inside the country, and because a consent banner is built to hold the page until a visitor chooses, a banner that can't load can hold up the very page it is meant to gate. Reachability is the delivery half of the question, not the legal half that decides whether you may use it. | Cookie Information — consent-script embed observed on cookieinformation.com, retrieved 2026-10-07 |
| PIPL puts the cross-border duty on you, not on the vendor. Because the consent, scan and preference records cross the border, the personal-information handler — you, Cookie Information's customer, not Cookie Information — must give notice, obtain separate consent, and satisfy one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. | PIPL Chapter III, Articles 38–43 |
| For some handlers the data must stay in China — and serving from inside the mainland triggers an ICP filing. Where the handler is a critical information infrastructure operator or moves personal information at volume, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — which an EU consent store cannot satisfy. And any public site actually served from inside China must carry an ICP filing (State Council Order No. 292; MIIT Order No. 33), bound to a mainland hosting resource Cookie Information does not provide. | PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37); State Council Order No. 292; MIIT Order No. 33 |
| A GDPR-shaped banner is engineered for a different regime. Cookie Information's homepage advertises native Google Consent Mode v2 and IAB TCF v2.2 support, and its research tracks the Danish, Swedish, Norwegian and Finnish regulators — all GDPR instruments. A consent flow valid under IAB TCF is not automatically PIPL's "separate consent," and an EU-hosted consent log does not meet a mainland data-residency duty. Meeting one framework is not meeting the other — a gap to confirm with counsel, not a verdict. | Cookie Information — homepage (Google Consent Mode v2, IAB TCF v2.2), retrieved 2026-10-07 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the deciding question about Cookie Information is not how fast its banner paints — it is which law that banner answers to, and where the consent it collects is kept. Cookie Information is a consent management platform: it blocks cookies until a visitor chooses, scans a site for trackers, and files away the record that proves consent was given. On its own homepage it is “EU-headquartered in Copenhagen,” with “data hosted in the Netherlands.” That is a precise fit for European law — and precisely the problem in China. Aimed at mainland visitors as-is, the tool bought to demonstrate compliance can become the exposure: the record proving a Chinese visitor consented is personal information that has left the mainland, and a banner engineered to GDPR answers a regime that is not PIPL.
Cookie Information in China at a glance
| What decides it | In Cookie Information's own terms |
|---|---|
| What it is | A GDPR cookie-consent management platform: it blocks cookies before consent, scans for trackers, and keeps consent records. Built to EU instruments — Google Consent Mode v2 and IAB TCF v2.2. |
| Where the data lives | “Data hosted in the Netherlands,” with “audit-ready consent records on EU servers.” EU-headquartered in Copenhagen — no region inside mainland China. |
| How the banner reaches visitors | The consent script is fetched from Cookie Information's offshore app CDN (policy.app.cookieinformation.com). From inside China an offshore gate like this can load slowly or fail. |
| Your China visitors' consent data | Consent choices, scan results and identifiers captured from Chinese users sit on EU servers — a cross-border transfer of personal information PIPL governs. |
| The regime it answers | GDPR, IAB TCF v2.2 and Consent Mode v2 are EU frameworks. A consent flow valid under them is not automatically PIPL's separate-consent and cross-border mechanics. |
The irony — a consent tool that can become the exposure
Cookie Information exists to prove you collected consent lawfully, and for a European site it does that well. The inversion happens at the border. On its homepage the platform keeps “audit-ready consent records on EU servers,” with “data hosted in the Netherlands” — so the consent choice, the cookie-scan result and the visitor identifier it captures from someone in China are all held outside the mainland. Under China’s Personal Information Protection Law that is a cross-border transfer of personal information: the handler — you, Cookie Information’s customer, not Cookie Information — must give notice, obtain separate consent, and clear one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification). The record meant to demonstrate compliance is itself the transfer the law regulates.
A GDPR banner is not a PIPL posture
Cookie Information is built to European instruments. Its homepage advertises native Google Consent Mode v2 and IAB TCF v2.2 support, and its own research tracks the Danish, Swedish, Norwegian and Finnish data-protection authorities — all GDPR enforcement. PIPL is a separate regime with its own consent definition and its own cross-border rules. A consent string that is valid under IAB TCF is not automatically PIPL’s “separate consent,” and an EU-hosted consent log does not satisfy a mainland data-residency duty. Satisfying one framework is not the same as satisfying the other. This is a risk to confirm with counsel rather than a verdict: whether PIPL’s cross-border and residency obligations apply to you, and how heavily, depends on your role as handler, the volume of personal information you move, and who your users are.
Served from offshore — and the in-country fix brings ICP into play
There is a delivery half to the question too. Cookie Information’s banner is fetched from its own app CDN outside the mainland — the embed loads policy.app.cookieinformation.com — and from inside China an offshore script like that can load slowly or fail outright. Because a consent banner is designed to gate the page until the visitor chooses, a gate that cannot load can hold up the very page it guards. But reachability is not what decides whether you may use the tool. The lawful way to keep your China users’ consent data on Chinese soil, and to serve the gate from inside the mainland, runs through in-country infrastructure — and any public site actually served from within China carries an ICP filing (State Council Order No. 292; MIIT Order No. 33), bound to a mainland hosting resource Cookie Information does not provide. For a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty an EU consent store cannot meet.
Where 21YunBox fits — a compliant overlay, not a migration
You keep running Cookie Information. We add the piece a Netherlands-hosted, EU-framework consent platform cannot: compliant, ICP-filed delivery from inside the mainland, placed in front of the stack you already run — no rebuild, no second codebase, and no move off Cookie Information. Our China compliance team maps the PIPL cross-border and data-residency obligations that attach to the consent and scan data Cookie Information collects — for your entity, your data volumes and your users — and stands up the in-country delivery and storage a lawful China presence needs, while your consent tooling stays exactly where it is.
Related reading:
