Does Google Cloud Translation Work in China? PIPL Cross-Border Data Transfer & Content Residency

For a product or support team serving mainland China, the deciding question about Google Cloud Translation is not whether the API answers from inside the country — it is what happens to the text you hand it. Cloud Translation is a raw machine-translation service: you send a string to an HTTPS endpoint and Google returns the translation, processed on its servers outside mainland China. The content you most need translated — support tickets, HR and legal files, contracts, product copy, user-generated content — is exactly the content most likely to carry names, email addresses, ID numbers, and confidential business information. Google’s own Data usage FAQ is reassuring on retention: it does not train on your text, holds it only briefly in-memory, and does not share it. But that does not change the fact that every call ships your content across the border — a cross-border transfer of personal information (PIPL Articles 38–40), with separate handling for sensitive content (Article 28), and content residency under the Cybersecurity Law where a CIIO or high-volume handler’s storage duty bites.

Google Cloud Translation in China at a glance

What decides whether you can send mainland-China content to Google Cloud Translation is not reachability — it is the content you transmit and where it is allowed to rest.

What you actually send — and where it goes

Google Cloud Translation comes in two tiers, and both are managed cloud services with no on-premises option. The Basic API and AutoML Translation use a single global endpoint; the Advanced API adds EU and US multi-regional endpoints — translate-eu.googleapis.com and translate-us.googleapis.com — that keep data at rest and machine-learning processing within the EU or US. Useful as those are for EU or US residency obligations, none of them is in mainland China: the regional endpoints change where within Google’s offshore footprint your content sits, not whether it leaves China.

What you send is the exposure. For the raw online API, each translateText call ships a string to Google and returns the translation; Google’s Data usage FAQ says that text is “held briefly in-memory” to perform the translation and is not retained to train models or shared with third parties. That is a genuinely good retention posture — and it is the honest half a compliance-minded buyer should keep. But some things persist offshore even so: glossaries, which Google says are “encrypted and stored securely on Google Cloud,” and custom AutoML models, which are built from datasets you upload. And the Advanced API’s batch mode reads your source documents from, and writes translated output to, Cloud Storage buckets — so a batch localization job leaves a durable copy of your content in an offshore bucket. The content you most need translated — tickets, contracts, HR and legal files — is exactly the content most likely to carry the personal, sensitive, and confidential information that makes where it goes a legal question.

It’s a cross-border data transfer — under PIPL

Sending a document abroad to be translated is a cross-border transfer of everything in it. Because Google Cloud Translation processes your text outside mainland China, every call moves any personal information in that text across the border, and China’s Personal Information Protection Law governs the leg. Under PIPL Articles 38–40 (数据出境), the personal-information handler — you, the Cloud Translation customer, not Google — must give data subjects notice, obtain a separate consent for the cross-border transfer, and satisfy one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. The 2024 cross-border rules set volume-based exemptions, so the exposure scales with your data volume and role rather than merely with using the API.

Two further prongs attach. Where the text carries sensitive personal information — medical, financial, legal, biometric, religious, or ID data — PIPL Article 28 requires separate consent and a prior personal-information protection impact assessment, and you cannot anonymize a document you need translated in full. And where you are a critical information infrastructure operator or a high-volume handler, China-collected personal information must be stored in-country under the Cybersecurity Law — Article 39 (formerly Article 37); the 2025 Cybersecurity Law amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39, its substance unchanged — a duty no offshore translation region can satisfy. For the glossaries, custom models, and batch outputs that come to rest on Google’s infrastructure, that storage duty is the one to check.

Reaching the API isn’t the question — keeping the content in-country is

The instinct is to ask whether the endpoint responds from inside China. It is the wrong axis. The question is where your source content is allowed to come to rest, and for Google Cloud Translation the answer is “outside the mainland,” because Google runs no region there. Two moves follow, and neither is a tunnel that ships the content offshore anyway.

First, keep China-origin content in-country, and minimize what it carries. Google Cloud Translation cannot be self-hosted or deployed on-premises — unlike some machine-translation vendors, there is no private or in-country deployment of the Google engine to stand up — so for content that pertains to people in China, the lawful path is a licensed in-country machine-translation or localization service that keeps the text on mainland infrastructure, combined with minimizing and pseudonymizing the personal information in strings before anything is translated. Keep what must stay in China on an in-country path; send offshore only what lawfully may go.

Second, govern the transfer you do keep. Inventory which strings and documents flow to Cloud Translation, what personal or sensitive information they carry, and whether you have a lawful basis — notice, separate consent, and a transfer mechanism — for the cross-border leg; where you do use the offshore engine for non-China content, pin it to a regional endpoint, rely on Google’s no-retention posture, and document where glossaries, custom models, and batch outputs reside.

This is a risk map, not a verdict. Your exact duties turn on your data volumes, whether you are a CIIO, and the sensitivity of the content — settle the specifics with counsel.

The lawful path — map, localize, deliver

21YunBox is a compliant overlay and partner, not a competitor to your translation vendor. We map what content flows to Google Cloud Translation and the personal, sensitive, and confidential information it carries; we localize by keeping China-origin content’s translation on a lawful in-country path — a licensed domestic translation or localization service with data kept in China, plus minimized and pseudonymized personal information in strings — so China content stops being exported offshore to be translated; and we deliver the China-facing site or app that consumes the translations through the 21YunBox Optimizer, with a compliant ICP filing, in front of the stack you already run — no rebuild, no migration. The result runs legally and compliantly for your users in China. 21YunBox never uses or suggests circumvention of any kind.

Get a compliance assessment →

Related reading

• Cross-border data transfers under PIPL
• China Cybersecurity Law
• China data export security assessment measures
• ICP license for your website

RELATED TECHNOLOGIES

Amazon Translate

Amazon Translate

Crowdin

Crowdin

DeepL

DeepL

Lokalise

Lokalise

Microsoft Translator

Microsoft Translator

Phrase

Phrase

Smartling

Smartling