Does Google Ads Work in China? PIPL Cross-Border, Profiling Consent & Data Transfer

The question teams ask about Google Ads in China is usually whether the tag still fires — whether the conversion and remarketing snippet loads and the numbers come back. For a mainland audience that is the wrong test. Google Ads is not operated as a service in mainland China, and the ad and tag endpoints the snippet calls are not reliably reachable from inside the country, so on a China-facing page the tag is dead weight — a third-party request your page waits on and does not control, one that stalls or times out for mainland visitors while returning no measurement. The deeper issue is what the tag is built to do: wherever it does resolve, it collects behavioral personal information and sends it to Google offshore. Under China’s privacy law that is three things at once — a cross-border transfer of personal information (PIPL Articles 38–40), an automated-decision and profiling mechanism (Article 24), and behavioral tracking that needs a separate, informed consent (Articles 13 and 23).

Google Ads in China at a glance

What the Google Ads tag actually sends — and where

Google Ads is the advertiser brand that absorbed AdWords in Google’s 2018 rebrand; the former DoubleClick advertiser products now sit inside Google Marketing Platform (Display & Video 360, Campaign Manager 360, Search Ads 360), and the conversion and remarketing tags still set and read ad cookies on google.com and doubleclick.net. Whatever you call it, the mechanism is the same: a snippet — the Google tag, gtag.js — on your pages that watches what visitors do and reports it back to Google.

What it reports is personal information. On its advertising privacy page Google states it “uses cookies or other identifiers (like your IP address or information you previously shared with the website)” to serve “ads based on websites you have visited,” and that the server logs it keeps “typically include your web request, IP address, browser type, browser language.” Turn on Enhanced Conversions and the tag goes further, “sending hashed first party conversion data (from your website tags or your imported offline events) to Google” — applying “a secure one-way hashing algorithm called SHA256 on your first party customer data, such as email addresses, before sending to Google.” Cookie IDs, IP address, page activity, conversions, and — with that feature — a hashed email: all of it flows to Google.

And Google’s infrastructure is offshore. Google operates no data center in mainland China, so there is no in-country region for any of this to land in — which is what makes the sub-type cut both ways. Because Google Ads is not operated in the mainland and its endpoints are unreliable from inside the country, the tag frequently returns nothing: dead weight that still costs you a stalled or failed third-party request on every mainland page load. But dead weight is not harmless. On any visitor, network or path where the call does complete, it has already collected personal information and begun moving it out of China. You carry the liability without getting the measurement.

It’s a cross-border transfer and a profiling mechanism — under PIPL

Where the data goes decides the law. Because Google’s ad infrastructure sits outside the mainland, sending a Chinese visitor’s cookie IDs, IP address and behavior to it is a cross-border transfer of personal information under China’s Personal Information Protection Law. The handler — you, the site operator, not Google — owes three things: notice to the individual, a separate consent for the overseas transfer distinct from any general agreement to use the site, and one lawful transfer mechanism: a CAC security assessment, the CAC standard contract, or certification (PIPL Articles 38–40).

Consent does not begin at the border. Setting a non-essential tracking cookie at all needs a lawful basis, which for behavioral advertising is informed consent captured before the tag fires (Article 13); handing that visitor data to Google and the ad ecosystem is a provision of personal information to a third party, which under Article 23 needs its own notice and separate consent. A single cookie banner that quietly does all three does not discharge them.

Then there is the profiling itself. Building a behavioral profile to decide which ad follows which user is the textbook case of what PIPL Article 24 governs — automated decision-making used for information push and commercial marketing. The article requires the process to be transparent and its outcomes fair, and, for marketing aimed at individuals, that you offer an option not based on their personal characteristics, or a convenient way to refuse. A campaign that only knows how to target by profile does not meet that on its own.

Google Consent Mode does not resolve any of this. It is a signal, not a residency control: in Google’s words “The tags send the consent states to Google,” communicating a visitor’s choice so the tags adjust their behavior — the data still goes to Google, offshore. The EU, UK and Swiss data-residency options are European features, not a mainland-China region. And for a critical information infrastructure operator or a large-volume handler, personal information generated in China must be stored in China — Cybersecurity Law Article 39 (formerly Article 37 — the 2025 Cybersecurity Law amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39, with the substance unchanged); PIPL Article 40 — a duty offshore ad infrastructure cannot satisfy however its consent and regional settings are tuned.

Making the offshore tag reachable is the wrong fix — what actually works

The instinct, once you see the tag failing from the mainland, is to find a way to make the offshore endpoint load anyway. For a China audience that is exactly backwards. Forcing the Google Ads tag to reach Google from inside China does not cure the problem — it completes the unconsented cross-border transfer and the profiling the law is concerned with, turning a latent liability into a live one on every mainland visitor. The compliant direction is the opposite.

Gate or suppress the offshore tag for mainland visitors. Detect the China audience at the edge and withhold the Google Ads conversion and remarketing tags from it, so no behavioral data is set or sent without a lawful basis; serve the tag only to the consented, out-of-scope audiences where it belongs. Honor the Article 24 right to refuse profiled marketing, and capture the separate consents before anything fires. Where you still need measurement or advertising that actually reaches Chinese users, route it through a licensed, in-country advertising-and-analytics alternative — a domestic platform whose data is processed and stored in the mainland on a lawful basis — rather than the offshore tag. Localizing here means stopping the unconsented offshore export and replacing it with a compliant in-country path, not pointing the same offshore tag at China by another route.

None of this is a ruling that Google Ads is banned in China. It is a risk map: which duties actually bite depends on what your tags collect, your data volumes, your role under Chinese law, and who your users are — settle the specifics with counsel before a China campaign relies on any of it.

The lawful path — map, localize, deliver

There is a compliant way to run advertising and measurement for a China audience, and it starts by separating the legal question from the technical one.

First, map. Our China compliance team inventories which ad and tracking tags fire on your mainland-facing pages — the Google Ads conversion and remarketing tags and anything riding alongside them — and charts, for each, what behavioral personal information it sends offshore and where you lack a lawful basis: the consent and notice you owe before a tag fires, the separate consents that third-party provision and the cross-border transfer each require, the Article 24 options you owe on profiled marketing, and where a data-export security assessment or an in-country storage duty bites. The legal conclusions are settled with your counsel; we build the technical picture that feeds them.

Then localize. We gate, suppress or defer the offshore tags for your mainland visitors and honor consent and the right to refuse, so the unconsented export simply stops — and where you still need to reach Chinese users, we stand up a lawful, in-country path on a licensed domestic alternative, its data processed and stored in the mainland, rather than shipping each visitor’s profile to Google by default. The shape is a compliant in-country pattern, not an offshore tag forced to load.

Then deliver. The China-facing site that carries the tags is a public internet service in the mainland, so it needs an ICP filing and compliant, in-country delivery. 21YunBox delivers it in-country — the 21YunBox Optimizer — set in front of the stack you already run, with no rebuild and no re-platform. The result is a site and a measurement setup that run legally and compliantly for your users in China. 21YunBox never uses or suggests circumvention of any kind: we keep what must stay in-country, stop what must not leave, and deliver the rest in the open.

Get a compliance assessment →

Related reading:

• Cross-border data transfers under PIPL
• China’s Cybersecurity Law (data localization, Article 39)
• China’s data-export security assessment
• How to get an ICP filing for China

RELATED TECHNOLOGIES

Adobe Audience Manager

Adobe Audience Manager

Adobe Dynamic Tag Management

Adobe Dynamic Tag Management

AdRoll

AdRoll

Microsoft Advertising (Bing Ads)

Microsoft Advertising (Bing Ads)

Bitly

Bitly

Criteo

Criteo

Google Tag Manager

Google Tag Manager

LinkedIn Insight Tag

LinkedIn Insight Tag

Meta Pixel

Meta Pixel

Taboola

Taboola

The Trade Desk

The Trade Desk