Does Gcore Work in China? Data Residency, ICP & Cross-Border Rules
Gcore is a Luxembourg-based edge network with no self-serve, ICP-filed mainland-China region, so China users' requests and data route through its offshore edges — a PIPL cross-border transfer on a public service that cannot be ICP-filed in-country. A compliance-first look at residency, ICP and CDN-licensing, not speed.
Does Gcore work in China?
Whether Gcore "works" in mainland China is a licensing and data-residency question, not a speed one: Gcore is a foreign edge network with no self-serve, ICP-filed mainland-China region, so your China users' requests terminate and their data routes through its offshore edges. Reaching Gcore's edges is not the test — the open questions are whether the public service is ICP-filed, whether operating a CDN to mainland users is licensed, and on what legal basis the handled request data crosses the border.
Gcore states the residency facts in its own terms: its contracting entity is a company incorporated in Luxembourg, and it may send customer content and data "to entities located in countries outside the EEA" under Standard Contractual Clauses — a European transfer basis, not a Chinese one. Its own CDN documentation groups edge-server regions into nine (North America, Europe, CIS, Asia, Australia, Latin America, Middle East, Africa, South America), none a mainland-China region you can target and file. So China users are answered from offshore, and moving their personal data across the border is a cross-border transfer under PIPL; an offshore edge also cannot hold the ICP filing a public mainland service requires.
This is a risk and residency picture, not a verdict — your obligations turn on your data, your role and your users. Our China team can map your exposure and a durable, ICP-filed path with you →
What Gcore's own documentation says about China
| Fact | Primary source |
|---|---|
| Gcore's contracting entity is a Luxembourg company, and its terms route customer data offshore. Gcore's own legal terms name the contracting party as "G-Core Labs S.A., incorporated under laws of Luxembourg," and provide that it may send customer content and data "to entities located in countries outside the EEA that may not provide an adequate level of data protection," relying on Standard Contractual Clauses. From China's standpoint the service and its data handling sit offshore, on a European — not Chinese — transfer basis. | Gcore — Legal Information on Gcore Services (gcore.com/legal), retrieved 2026-10-14 |
| Gcore publishes no mainland-China region in its own CDN model. Gcore's CDN documentation groups delivery by "regions of CDN edge servers" into nine values only — North America, Europe, CIS, Asia, Australia, Latin America, Middle East, Africa and South America — with no mainland-China region or partition a customer can target or file. There is no self-serve, ICP-filed mainland footing to anchor a compliant public service on Gcore's own network. | Gcore — CDN resource statistics documentation (docs.gcore.com/api-reference/cdn/statistics), retrieved 2026-10-14 |
| A public mainland service needs an ICP filing, and operating a CDN there is a licensed telecom activity. Any site or app served to mainland users must carry an ICP filing (备案) bound to a mainland hosting resource — an offshore edge cannot hold one. Operating CDN services to mainland users is itself a value-added telecom activity (增值电信业务) requiring a licence a foreign provider cannot hold directly, so there is no mainland CDN product a foreign entity can self-serve. How ICP filing works → | Telecommunications Regulations of the PRC (State Council Order No. 291); Administrative Measures on Internet Information Services (State Council Order No. 292, Art. 4); MIIT value-added telecom licensing (增值电信业务) |
| Routing China users' personal data to offshore edges is a regulated cross-border transfer. Carrying mainland users' personal information — IP addresses, cookies, request logs, payloads — to edges outside the mainland is a cross-border transfer under PIPL (notice, separate consent and one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification; Articles 38–40). A CIIO or large-volume handler must also store China-collected personal information in the mainland (Cybersecurity Law Article 39 (formerly Article 37); PIPL Article 40) — which an offshore edge cannot do. | Personal Information Protection Law, Articles 38–40; Cybersecurity Law Article 39 (formerly Article 37) |
Sources verified by the 21YunBox compliance team on 2026-10-14.
Whether Gcore “works” in mainland China is a question of licensing and data residency before it is one of performance. Gcore is a foreign edge network — its contracting entity is a company incorporated in Luxembourg — and it publishes no mainland-China region you can self-serve and file. Point a mainland audience at it and their requests are terminated and their response data routed through edges outside the mainland, on a public-facing service that cannot hold the ICP filing in-country delivery requires. Gcore states the residency facts in its own terms.
Gcore in China at a glance
| What decides it | In Gcore's own terms — and the rule it triggers |
|---|---|
| Where the entity and data sit | Gcore's contracting entity is “G-Core Labs S.A., incorporated under laws of Luxembourg,” and its terms allow sending customer content and data “to entities located in countries outside the EEA,” relying on Standard Contractual Clauses. The service and its data handling are offshore from China's standpoint. |
| Mainland-China region | Gcore's own CDN documentation groups edge-server regions into nine — North America, Europe, CIS, Asia, Australia, Latin America, Middle East, Africa and South America — none of them a mainland-China region or partition you can target and file. |
| Serving the public | A public-facing service for mainland users needs an ICP filing tied to a mainland hosting resource. An offshore edge cannot be ICP-filed, so delivery through Gcore's own network alone has no filed in-country footing. |
| CDN licensing | Operating CDN services to mainland users is a licensed value-added telecom activity (增值电信业务). A foreign provider cannot hold that licence directly — so there is no mainland CDN product a foreign entity can self-serve. |
| Cross-border data | China users' request and response personal data routed to offshore edges is a cross-border transfer under PIPL (notice, separate consent, a transfer mechanism; Articles 38–40). A CIIO or large-volume handler must store China-collected personal information in the mainland (Cybersecurity Law Article 39 (formerly Article 37)). |
Door one — a foreign edge network with no ICP-filed mainland footing
The first door is not speed; it is whether the public-facing service is filed and whether the delivery is licensed. Any site or app served to mainland users needs an ICP filing (备案) bound to a mainland hosting resource — a domain without ICP recordal or an ICP licence may not lawfully provide an Internet information service to the public there. An edge outside the mainland cannot hold that filing, and Gcore publishes no mainland-China region in its own network model to anchor one.
Operating a CDN to mainland users is itself a licensed value-added telecom activity under Chinese law (CDN falls under 增值电信业务). A foreign provider cannot hold that licence directly; lawful in-country delivery runs on a mainland-licensed footing tied to a China entity and an ICP filing. So “our edges are reachable from China” does not carry into a compliant mainland presence — the ICP gate and the telecom-licensing gate sit upstream of reachability, and Gcore’s own network does not clear them for you.
Door two — China users’ data routes and rests offshore
Because Gcore has no mainland region, your China visitors are answered from edges outside the mainland. Where that traffic carries personal information — IP addresses, cookies, request logs, form and API payloads — moving it across the border is a cross-border transfer under the Personal Information Protection Law: the handler (you, not Gcore) must give notice, obtain separate consent, and satisfy one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification (PIPL Articles 38–40). Gcore’s own terms make the destination explicit: it may send customer content and data “to entities located in countries outside the EEA,” governed by Standard Contractual Clauses — a European transfer basis, not a Chinese one.
For an operator classed as a CIIO, or a handler above the volume thresholds, personal information collected in China must additionally be stored inside the mainland (Cybersecurity Law Article 39 (formerly Article 37); PIPL Article 40) — which an offshore edge cannot do. None of this is a verdict that Gcore is “blocked” or “illegal.” It is a risk-and-residency map: which obligations bite turns on your entity, the personal data your traffic carries, your role under Chinese law, and who your users are — worth settling with counsel before your delivery depends on it.
Why a reachability check misses this
A “does it load / is it fast from China” test terminates the moment the bytes arrive. It never sees the three things that actually decide compliance: whether the public service is ICP-filed, whether operating the CDN to mainland users is licensed, and where the handled request and response data comes to rest and on what legal basis. Those gates sit upstream of the first byte. That is the half a performance probe — or a competitor who sells only speed — structurally cannot answer: a fast offshore edge and an unfiled, cross-border data path are perfectly compatible, and only one of them is the question Chinese law asks.
Where 21YunBox fits — map, localize, deliver
You keep building on Gcore. We add the piece a foreign edge network leaves to you — a lawful, ICP-filed, in-country footing — as a compliant overlay in front of your existing origin, with no rebuild and no second codebase:
- Map — we assess your PIPL cross-border and data-residency exposure for your entity, your data volumes and your role under Chinese law, so you know which obligations actually bite.
- Localize — we stand up the mainland footing a compliant public service needs: the ICP filing and the licensed in-country delivery an offshore edge cannot hold.
- Deliver — we run compliant, ICP-filed delivery from inside the mainland on top of the Gcore stack you already operate, and govern the cross-border back-haul to your offshore systems so that round-trip is itself on a lawful basis.
This is a cooperative overlay, not a migration off Gcore — the point is to settle the ICP, licensing and residency questions its own network does not, before your China audience depends on them.
Related reading:
- How to get an ICP filing for China
- Cross-border data transfers under PIPL
- China’s Cybersecurity Law and data localization
