Does Demandbase Work in China? Visitor-IP Data Residency, PIPL Cross-Border & Automated Profiling

For a company running Demandbase on a China-facing website, the first instinct is to ask whether the tag loads from Shanghai. That is not where the China decision is made. Demandbase’s entire purpose is to de-anonymize the people who land on your site — to read each visitor’s IP address, resolve it to a company, and build an intent and engagement profile around that account — and to keep the resulting records on its own cloud infrastructure. For a visitor in mainland China, the IP address Demandbase reads and the de-anonymized record it assembles are personal information, and Demandbase holds them outside the country. So two questions arrive before performance ever does: where that personal information is allowed to live, and whether you had a lawful basis to profile the person in the first place. Demandbase settles the first in its own security and privacy documentation.

Demandbase in China at a glance

Where the visitor data lives — offshore, in Demandbase’s own words

Demandbase’s position is set in its own documentation, not by a load-time test. Its Security Policy states that “Demandbase uses Amazon Web Services (AWS) and Google Cloud Platform (GCP) as the primary cloud platforms,” and that this infrastructure “spans multiple regions and multiple availability zones within each region.” Neither of those clouds runs a commercial region inside mainland China — Google Cloud operates none, and the AWS China partition is a separate, locally operated environment, not the global AWS Demandbase describes. Its Privacy Notice (effective April 21, 2026) is just as plain about destination: it says Demandbase may “transfer, store, or process your personal information in a country outside your jurisdiction,” “including the United States,” and relies on standard contractual clauses when moving data out of the EEA, Switzerland or the UK. No mainland-China location appears anywhere in either document.

So the visitor records Demandbase builds from your Chinese traffic come to rest in the United States or Europe. Under China’s Personal Information Protection Law that is a cross-border transfer (数据出境) of personal information, and the duty falls on the handler — you, the site operator, not Demandbase the processor. PIPL Articles 38–40 require notice, a separate consent for the overseas transfer distinct from any general agreement to use your site, and one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. Above certain volumes, or where the data counts as “important data,” the transfer may also need China’s data-export security assessment (数据出境安全评估) before anything leaves. And if your organization is a critical information infrastructure operator, the Cybersecurity Law’s Article 39 (formerly Article 37 — the data-localization clause was renumbered by the 2025 amendment that took effect on January 1, 2026, with its substance unchanged) requires personal information generated in China to be stored in the mainland, which an AWS or GCP account outside the country cannot satisfy.

A visitor’s IP address is personal information — and de-anonymizing it is profiling

The residency question is only half of it, and Demandbase raises a second half that a plain analytics tool does not. Its core function is to de-anonymize web traffic: it reads a visitor’s IP address and resolves it to a company, drawing on what it describes as a dataset of “around 3.7 billion IP addresses that are mapped to a company or otherwise classified,” supplemented by more than a billion cookies (Demandbase, retrieved 2026-10-09). Under Chinese practice an IP address is itself personal information — so before any data crosses a border, reading a mainland visitor’s IP and attaching an account identity and an intent score to it is already processing of personal information, which PIPL requires a lawful basis for: in practice informed consent and clear notice before the tag begins collecting (PIPL Article 13).

It goes one step further. Because Demandbase then builds account-level profiles and uses them to target, personalize and prioritize outreach, that is automated decision-making under PIPL Article 24 — which layers on its own duties: transparency and fairness in the decision, a visitor’s right not to be subject to a decision made solely by automated means, and, for commercial messaging driven by those profiles, an option that is not targeted to the individual’s characteristics or an easy way to refuse. This duty bites on the profiling itself: it applies to the identifiable visitors you observe in China even for data that never leaves the country. Whether your identifiers count as personal information in a given flow, whether any field is sensitive, and exactly what your consent and notice must say are questions to settle with counsel.

Why pointing Demandbase at “a different region” isn’t the fix

The reflex is to flip Demandbase to an in-region setup and keep the data local — but the only places Demandbase runs are AWS and Google Cloud regions outside the mainland. Moving a China visitor’s record from a US environment to a European one relocates the cross-border transfer; it does not end it, because neither is in China. Keeping China-collected visitor data in the country means standing up a consented, China-resident footing for the IP-derived identifiers and account records, and sending Demandbase only what may lawfully leave. That split — what must stay, what may go — is the heart of the work, and it is a legal question before it is a technical one.

None of this is a verdict that Demandbase is “blocked” or “illegal.” It is a risk map: which obligations bite — a separate consent, a transfer mechanism, a data-export assessment, in-country storage, an ICP filing, or some combination — turns on your entity, the data your tag actually collects, your role as handler, and who your visitors are. It is worth settling with counsel before your China-facing marketing depends on it.

The lawful path — map, localize, deliver

There is a lawful way to run account-based marketing for a China-facing site, and it has three moves.

First, map. Our China team works through the PIPL exposure on both fronts at once — the profiling and the transfer. We identify which visitor identifiers and de-anonymized records collected in China are personal information, what (if anything) may lawfully leave, where a data-export security assessment or an Article 39 storage duty applies, and what your consent and notice flow must tell a visitor before the tag starts reading their IP. The legal conclusions are yours to confirm with counsel; we build the technical and data-flow picture that feeds them.

Then localize. We stand up and integrate a consented, in-country footing for the China visitor data — the IP-derived identifiers, the engagement signals, the account records — so the de-anonymization and intent work you rely on keeps running while that personal information stops leaving the country by default. You keep Demandbase for the markets where it already serves you, and send it only what may lawfully cross the border. Where there is no clean domestic equivalent, the pattern is the point: consented collection, in-country processing and storage, and a minimized, lawful export — not a named product swap.

Then deliver. The China-facing site that carries the Demandbase tag is itself a public service in the mainland, so it carries an ICP filing (备案) duty and needs compliant, in-country delivery. 21YunBox delivers it in-country — the 21YunBox Optimizer — in front of the site you already run, with no rebuild and no re-platform. The outcome is account-based marketing that runs legally and compliantly for your users in China. What we never do — and what no one lawfully can — is hand you a route around China’s data-export rules or around any network restriction: we localize what must stay and deliver in-country, and 21YunBox never uses or suggests circumvention of any kind.

Get a compliance assessment →

Related reading:

• Cross-border data transfers under PIPL
• China’s data-export security assessment
• China’s Cybersecurity Law (data localization, Article 39)
• How to get an ICP filing for China

RELATED TECHNOLOGIES

6sense

6sense

Clubexpress

Clubexpress

Drift

Drift

Eloqua

Eloqua

Freshdesk

Freshdesk

HubSpot

HubSpot

Marketo

Marketo

Pardot

Pardot

Salesforce Marketing Cloud

Salesforce Marketing Cloud

ServiceNow

ServiceNow

Tidio

Tidio

Wildapricot

Wildapricot

Zendesk

Zendesk

Zoho CRM

Zoho CRM