Does Gatsby Work in China? ICP, Data Residency & an Offshore Build
Gatsby is a React build framework, not a host — its output deploys to offshore platforms like Netlify, Vercel, GitHub Pages or S3/CloudFront, none inside mainland China. So a public Gatsby site reaches China from offshore, with no ICP-filing path in-country and your visitors' data crossing the border under PIPL. A compliance-first look at the two doors.
Does Gatsby work in China?
For a public, mainland-China audience the honest answer is "not by itself" — and the reason is licensing and location, not how Gatsby performs. Gatsby is a build step, not a host: it turns your React project into production output and hands that output to a deployment platform, and every platform Gatsby itself names sits offshore, with none inside mainland China.
In Gatsby's own words it is a "React-Based Framework" you use to "Build a fast, secure, and powerful website"; its deployment docs then describe "taking the production output from Gatsby and turning it into something your deployment platform understands" and list that platform as one of Netlify, AWS Amplify, Azure Static Web Apps, Firebase, GitHub Pages, GitLab Pages, Heroku, S3 & CloudFront or Vercel — all offshore (Gatsby Cloud itself has folded into Netlify). Two things follow for a public China site, set against Gatsby's own wording in the table below: a site served from that offshore host has no ICP filing to attach to in-country, and reaching it from the mainland is a delivery question, not a given. Whatever personal data the (mostly static) site collects then leaves the country, which adds a lighter PIPL question on top.
This is a risk picture to take to counsel, not a verdict — what applies depends on whether you serve the public in China, your entity, and the data your site handles. Our China team can map the Gatsby + 21YunBox path with you →
Compliance snapshot
- ✓ Keep building in Gatsby — your React codebase, content sources and build pipeline don't change
- ✕ No ICP-filing path in the Gatsby chain — its build output deploys to offshore hosts (Netlify, Vercel, Pages, S3/CloudFront), none in mainland China
- ! Reachable but uneven: gatsbyjs.com finished loading from a mainland datacenter probe yet 0 of 3 times on a Beijing home line (2026-08-28 / 08-30, 3 runs each)
- ! A static site still pulls offshore fonts, scripts and the host's edge, and carries visitors' real IPs across the border — a PIPL question
- ✓ Compliant path: ICP-filed, in-country delivery in front of your Gatsby build — an overlay, not a migration
What Gatsby JS's documentation says, and what we measured from inside China
| Fact | Primary source |
|---|---|
| In Gatsby's own words it is a build framework, not a host — its output is handed to a deployment platform, and every platform Gatsby names is offshore. Gatsby's homepage calls it "The Best React-Based Framework" and invites you to "Build a fast, secure, and powerful website using our React-based, open-source framework." Its deployment docs describe "taking the production output from Gatsby and turning it into something your deployment platform understands" and list that platform as Netlify, AWS Amplify, Azure Static Web Apps, Firebase, GitHub Pages, GitLab Pages, Heroku, S3 & CloudFront or Vercel — with Gatsby Cloud now folded into Netlify. Not one is a mainland-China host, so a public Gatsby site reaches the mainland from offshore and the licensing question lands on that offshore host, not on Gatsby. | Gatsby — homepage and "Preview, Deploys & Hosting" documentation, retrieved 2026-10-07 |
| A public mainland-China site needs an ICP filing, and a Gatsby build deployed offshore has nothing in-country for it to attach to. Under State Council Order No. 292 (Article 4) and MIIT Order No. 33, an ICP filing (备案) attaches to a hosting resource physically inside mainland China and to a mainland legal entity. A Gatsby site served from Netlify, Vercel, GitHub Pages or S3/CloudFront runs on offshore infrastructure with no in-country host and no mainland entity to file against — so the ICP door isn't on Gatsby, nor on those hosts. That is a licensing-and-location boundary, not a defect in Gatsby. | State Council Order No. 292 (Measures for the Administration of Internet Information Services), Article 4; MIIT Order No. 33 (ICP filing measures) |
| Even a mostly static Gatsby site touches personal information at the edge, so how that data crosses the border is a PIPL question. A visitor's real IP address and request logs are personal information; serving the mainland from an offshore host and carrying them out of the country is a cross-border transfer under PIPL (Chapter III, Articles 38–43: notice, separate consent, and one permitted transfer mechanism; Article 40, with Cybersecurity Law Article 39 (formerly Article 37), adds in-country storage for a CIIO or large-volume handler). A static marketing site is lighter here than a data-heavy app — but the compliant design answers it the same way: an in-country, ICP-filed entry that sends a fixed in-country IP to your origin rather than forwarding each visitor's real IP across the border. | PIPL Chapter III, Articles 38–43 and Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
Measured from inside mainland China, a Gatsby-built site was reachable but behaved very differently by vantage. 21YunBox requested gatsbyjs.com (Gatsby's own site, built and served on the kind of offshore host its docs recommend) from two mainland vantages, three runs each: from an Alibaba Cloud datacenter probe in cn-zhangjiakou on 2026-08-28 it finished loading on all 3 attempts, while from a Beijing residential broadband line on 2026-08-30 it answered and began painting on every run but finished loading on 0 of 3. The datacenter result does not describe what a visitor on a home connection sees — reachability from the mainland is real but uneven, and the shortfall is offshore delivery showing, not a hard block. | 21YunBox — China delivery measurement, measured from inside mainland China (cn-zhangjiakou 2026-08-28; Beijing residential broadband 2026-08-30; 3 runs per vantage) |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience the deciding question about Gatsby is not how fast it builds or paints — it is where the finished site is allowed to live and where your visitors’ data is allowed to go. Gatsby answers the first half in its own documentation: it is a build framework, not a host. It turns your React project into production output and hands that output to a deployment platform — and every platform Gatsby itself names is offshore, with none inside mainland China. So a public Gatsby site is reachable from the mainland yet served entirely from outside it, which leaves it with no footing for the ICP filing a public mainland site requires and turns any personal data it collects into a cross-border transfer China’s law governs. The reachability is real; the licensing and the data residency are the exposure.
Gatsby in China at a glance
| What decides it | In Gatsby's own terms |
|---|---|
| Where it runs | Gatsby is a build framework, not a host. It produces "production output" that you deploy to a platform — Netlify, AWS Amplify, Azure Static Web Apps, Firebase, GitHub Pages, GitLab Pages, Heroku, S3 & CloudFront or Vercel. None is inside mainland China, and Gatsby Cloud has folded into Netlify. |
| Who holds the ICP footing | An ICP filing attaches to a hosting resource physically inside mainland China and to a mainland entity. A Gatsby build deployed to any of those offshore hosts has neither — there is nothing in-country to attach one to. |
| Serving the public | A site served to mainland visitors from inside China needs an ICP filing tied to a mainland hosting resource. A Gatsby-to-offshore-host chain offers no such in-country host of its own. |
| Your visitors' data | Served offshore, a mainland visitor's real IP and request logs leave the country — a cross-border transfer PIPL governs, even for a mostly static site. |
| Is it reachable? | Yes — not blocked. Gatsby's own site finished loading on every datacenter-probe attempt from inside the mainland, though a Beijing home line did not complete; the gap is offshore delivery, not a block. |
A build tool with no in-country host, so no footing for an ICP filing
Gatsby does not run your site; it builds it. In Gatsby’s own words it is a “React-Based Framework” you use to “Build a fast, secure, and powerful website,” and its deployment docs describe adapters “taking the production output from Gatsby and turning it into something your deployment platform understands.” The platforms it lists — Netlify, AWS Amplify, Azure Static Web Apps, Firebase, GitHub Pages, GitLab Pages, Heroku, S3 & CloudFront and Vercel — are all offshore, and Gatsby Cloud has itself folded into Netlify. Not one sits inside mainland China.
That settles the licensing question before performance ever enters it. A public-facing website delivered to mainland visitors from inside China turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, and that filing must attach to a hosting resource physically located in the mainland and to a mainland legal entity. A Gatsby build deployed to an offshore host has neither — so there is simply nothing in the chain to file against. That is where “we already ship a Gatsby site” runs out: building a fast static bundle is not the same as being cleared to operate in China, and no amount of build tuning creates the in-country footing a filing needs.
Reachable, not blocked — but uneven, and that is the point
Gatsby sites are not blocked in China. In 21YunBox’s own measurements from inside the mainland, Gatsby’s own site answered quickly and finished loading on every attempt from an Alibaba Cloud datacenter probe in Zhangjiakou (2026-08-28), yet from a Beijing residential broadband line (2026-08-30) it answered and began painting on every run but finished loading on none — three runs at each vantage. We report reachability here, not a speed score; the datacenter result simply does not describe a home connection. A static Gatsby build helps, because a pre-rendered page has no server round trip to pay — but it still references offshore fonts, scripts and the host’s own edge, so it is only as reachable as those offshore dependencies. The exposure on a China-facing Gatsby site is therefore not mainly that people cannot reach it — it is that reaching it gives you neither an ICP filing nor in-country data residency. Those gaps are compliance facts, and no build setting closes them.
Your China visitors’ data still crosses the border
Serve a Gatsby site to China from an offshore host and your visitors’ personal information — at minimum their real IP addresses and request logs, more if the site carries forms or analytics — leaves the mainland. Under China’s Personal Information Protection Law that is a cross-border transfer, and the handler — you, not Gatsby or your host — must give notice, obtain separate consent, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. If you are a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty no offshore host in Gatsby’s deploy list can satisfy. A mostly static marketing site is lighter here than a data-heavy app, but the compliant design still answers the question the same way.
This is a risk map, not a verdict: whether you need an ICP filing, in-country storage, or both depends on what you serve, how much personal data you hold, and who your users are — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep building with Gatsby and deploying it wherever you do today. We add the one piece a build tool and an offshore host cannot: compliant, ICP-filed delivery from inside the mainland, set in front of the site your Gatsby build produces — no rebuild, no second codebase, and no move off Gatsby, Netlify, Vercel or Pages. Our China team maps your ICP and data-residency obligations against your entity and data volumes, then stands up the in-country delivery and storage a lawful China presence needs, while your framework and host stay exactly where they already are.
Related reading:
Frequently Asked Questions
Do we have to leave Gatsby or rebuild to serve mainland China?
No. The compliant pattern is an overlay, not a migration: Gatsby stays your framework, your content sources and your build, and an ICP-filed, in-country delivery layer — fed from the same Gatsby build you already ship — is placed in front of it for mainland visitors. There is no rebuild, no second codebase, and no change to how you write or deploy your Gatsby site.
Why can't Gatsby or our host (Netlify, Vercel, Pages) hold the ICP filing?
Because an ICP filing attaches to a licensed host physically inside mainland China and to a mainland legal entity, and Gatsby's build output deploys to offshore platforms — Netlify, Vercel, GitHub Pages, S3/CloudFront and the like. There is no in-country host and no mainland entity in that chain for the filing to sit on. That is a licensing-and-location boundary, not a flaw in Gatsby or those hosts, which stay your build and deploy targets; 21YunBox supplies the ICP-filed, in-country delivery in front of them.
Can 21YunBox help make our Gatsby site work in mainland China?
Yes. Our China team can assess the ICP, reachability and cross-border-data exposure for your entity and your data, handle the ICP filing, and stand up compliant, ICP-filed in-country delivery in front of the site your Gatsby build produces — so Gatsby and your current host stay exactly where they are. Get in touch to work through your specific case, and treat the specifics as a risk picture to confirm with counsel.
