Does Drift Work in China? PIPL, Visitor Conversations & an Offshore Chat Widget
Drift — now part of Salesloft — is a chat widget that loads on your site from offshore servers and records what visitors type along with their lead details, with no mainland-China region. So a China visitor's conversation is a cross-border transfer of personal information under PIPL, and the widget itself depends on reaching those offshore servers. A compliance-first look at the two exposures.
Does Drift work in China?
Whether you can run Drift for a mainland-China audience is first a cross-border-data question, not a speed one. Drift — now part of Salesloft — is a chat widget that loads on your pages from offshore servers and records what visitors type along with the name, email and company behind each lead, so where that conversation data is allowed to live is what China's law responds to.
Salesloft's own Platform Privacy Notice says information you provide to the Services "may be transferred to, processed, and maintained on servers or databases located outside of the country or jurisdiction where you are located," and its website Privacy Notice is more specific — data "will be transferred to us in the United States" — with no mainland-China region named. So a China visitor's chat is captured offshore: a cross-border transfer of personal information PIPL governs, needing notice, separate consent and a transfer mechanism. And because the widget script itself is fetched from those same offshore servers, if it loads slowly or not at all the chat simply never shows up. The table below is Salesloft's own wording and the rules it triggers.
You are looking at an exposure map, not a ruling — what you owe depends on what the widget captures, how much of it, and who your visitors are. Our China team can map your Drift exposure with you →
Compliance snapshot
- ! The chat widget loads from offshore servers — if that fetch is slow or blocked, the chat silently never appears
- ! Captures what visitors type plus their lead and contact details — personal information sent offshore
- ! That offshore capture is a cross-border transfer of personal information under PIPL
- ✕ No mainland-China region or data-residency option for the conversation data
- ✓ A compliant in-country delivery path exists — no rebuild, no migration
What Drift's own documentation says about China
| Fact | Primary source |
|---|---|
| In Salesloft's own words (Salesloft now owns Drift): information you provide to the Services "may be transferred to, processed, and maintained on servers or databases located outside of the country or jurisdiction where you are located," and Salesloft relies on third parties "providing data center hosting services, database hosting services" — with no mainland-China region named in either notice. | Salesloft — Platform Privacy Notice (§7 International Transfers; §4 Sharing), retrieved 2026-10-07 |
| Salesloft's website Privacy Notice is more specific about where the data goes: "By submitting your personal information via this website or otherwise, your information will be transferred to us in the United States." For a mainland-China visitor whose chat Drift captures, that is personal information leaving the country. | Salesloft — Privacy Notice (§6 International Transfers of Personal Information), retrieved 2026-10-07 |
| The chat text a visitor types, plus the name, email and company Drift records against each lead, are personal information. Capturing them on offshore servers is a cross-border transfer under China's Personal Information Protection Law: the handler — you, the site operator, not Drift — must give notice, obtain separate consent for the transfer, and satisfy one mechanism — a CAC security assessment, the CAC standard contract, or certification. | PIPL Chapter III, Articles 38–43 |
| The exposure scales with volume and role, not merely with embedding the widget: under the CAC's March 2024 cross-border data rules, a non-CIIO transferring fewer than 100,000 individuals' non-sensitive personal information in a calendar year is exempt from the security assessment, standard contract and certification. | CAC — Regulations on Promoting and Regulating Cross-border Data Flows, March 2024 |
| For a CIIO or large-volume handler, personal information collected in China must be stored inside mainland China (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). Salesloft names no mainland-China region, so the widget script is also fetched from offshore — the same offshore distance that can leave a visitor's data out of residency can keep the script from loading at all. We publish no first-party measurement of Drift from inside China, so we state this as a delivery risk, not a number. | PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the deciding question about Drift is not how fast its chat bubble pops up — it is where the conversations it captures are allowed to live, and whether the widget that captures them can load at all. Drift, now part of Salesloft, is a conversational-marketing widget: it drops a chat script onto your pages, records what visitors type, and files the name, email and company behind each lead. By Salesloft’s own privacy notices that data is processed on servers outside your country — in the United States — with no region inside mainland China. So a China-facing Drift widget carries two exposures at once: the personal information it captures leaves the country the moment a visitor types, and the script that does the capturing is fetched from the same offshore servers the mainland network reaches unevenly.
Drift in China at a glance
| What decides it | What it means for mainland China |
|---|---|
| Where the data lives | Salesloft (Drift's owner) processes data provided to the Services on servers “located outside of the country or jurisdiction where you are located,” and its website notice says data is “transferred to us in the United States.” No region is inside mainland China. |
| What Drift captures | The chat text visitors type, plus the name, email and company recorded against each lead. All of it is personal information; capturing it offshore moves it across the border the moment a visitor engages. |
| The cross-border transfer | PIPL governs it. The handler — you, the site operator, not Drift — must give notice, obtain a separate consent for the transfer, and satisfy one mechanism: a CAC security assessment, the CAC standard contract, or certification. |
| Data residency | For a CIIO or large-volume handler, personal information collected in China must stay in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — which US servers cannot satisfy. |
| Does the widget even load? | The chat script is fetched from offshore servers; a slow or blocked fetch means the bubble never appears. Whether it loads reliably for mainland visitors is a delivery question, separate from the law. |
No mainland region, so the conversation lands offshore
Drift’s conversational capability now sits inside Salesloft’s platform, and Salesloft answers the residency question in its own documentation. Its Platform Privacy Notice states that information you provide to the Services “may be transferred to, processed, and maintained on servers or databases located outside of the country or jurisdiction where you are located,” relying on third parties for “data center hosting services, database hosting services”; its website Privacy Notice puts a country on it — your information “will be transferred to us in the United States.” Neither names a region inside mainland China.
That settles the legal question before performance enters it. An email address, a phone number and the free text a visitor types into a chat are personal information, and the moment a mainland visitor engages the widget, that information is captured onto those offshore servers. Under China’s Personal Information Protection Law that is a cross-border transfer, and the obligation falls on the handler — you, the site operator running the widget, not Drift. You must give notice, obtain a separate consent for the transfer itself (a general “start chat” does not cover sending the data abroad), and clear one transfer mechanism. Where you are a critical information infrastructure operator or a large-volume handler, the data has to stay on Chinese soil altogether — a residency duty that offshore US servers cannot meet, and the point at which keeping your China visitors’ conversations in-country brings an ICP-filed mainland presence into the picture. None of that is a setting you can toggle inside Drift.
A chat widget only helps if it loads — and this one comes from offshore
Separate from the law, a chat widget is client-side: the browser has to fetch Drift’s script from its servers and initialize it before any bubble appears. When that fetch is served from offshore and the mainland network is in the way, the failure mode is quiet — not an error page, just no chat at all, on a site that looks otherwise fine. So the delivery question for Drift is sharper than it is for a passive page: it is not only “does the site feel slow,” it is “did the conversational layer you are paying for ever load for this visitor.” That is genuinely a delivery matter, and it turns on distance, third-party dependencies and network conditions rather than on the statute. We publish no first-party measurement of Drift from inside China, so we put no load figures here; it is something we would measure against your actual embed rather than assert. What tuning cannot change is the other half: whenever the widget does load and capture a conversation, that personal data still goes offshore.
Read this as a risk picture rather than a ruling: whether you need a transfer mechanism, in-country storage, or a reworked consent flow depends on what your widget captures, how much of it, and who your visitors are — worth settling with counsel before you build, not after.
Where 21YunBox fits — a compliant overlay, not a migration
You keep running Drift exactly where it is. We add the piece an offshore widget cannot provide on its own: compliant, ICP-filed delivery from inside the mainland for the pages your China visitors actually touch, and in-country storage where the law requires your China visitors’ conversation data to stay on Chinese soil — set in front of your existing stack, with no rebuild, no second codebase, and no move off Drift. Our China team maps your PIPL cross-border and consent obligations against your entity and your capture volumes, then stands up the in-country delivery and storage a lawful China presence needs, while Drift stays part of the stack you already run.
Related reading:
Frequently Asked Questions
Does Drift store Chinese visitors' chat data in China?
No. Salesloft — which now owns Drift — says in its Platform Privacy Notice that information you provide to the Services may be transferred to and maintained on servers located outside your country, and its website Privacy Notice says data is transferred to it in the United States. Neither names a mainland-China region, so the conversations and lead details Drift captures from your China visitors are held offshore.
Is it against the law to run a Drift chat widget for China visitors?
Not inherently. The issue is the cross-border transfer of personal information — the chat text and lead details the widget captures — which PIPL permits if you give notice, obtain a separate consent for the transfer and meet one of its mechanisms. Whether you also face a data-localization duty depends on your role (for example, whether you are a CIIO) and your volumes. Treat it as a risk to settle with counsel, not a blanket ban.
Can 21YunBox help make our Drift setup compliant in China?
Yes. Our China team can assess the cross-border and data-residency exposure for what your widget captures and your volumes, and stand up compliant, ICP-filed in-country delivery — and, where the law requires your China visitors' data to stay on the mainland, in-country storage — in front of your existing stack, with no rebuild. Get in touch to work through your specific case.
