Does Google Hosted Libraries Work in China? Reachability, a Blocked Google Host & Where ICP Applies
Google Hosted Libraries serves jQuery and other open-source JavaScript from Google's own domains (ajax.googleapis.com) — and Google's domains are heavily impaired behind the Great Firewall, so libraries loaded from it frequently fail or hang for mainland visitors and can break a China-facing page. The library CDN raises no PIPL issue; the fix is to remove the Google dependency, and the ICP duty sits on your own site. A compliance-first, reachability look.
Does Google Hosted Libraries work in China?
Whether Google Hosted Libraries works in mainland China is a reachability problem — and a specifically Google one. It serves open-source JavaScript libraries, not your users' data, so this is not a PIPL or data-residency question; the risk is that the files load from Google's own domains, which China's Great Firewall heavily impairs.
Google's own page calls the service "a stable, reliable, high-speed, globally available content distribution network for the most popular, open-source JavaScript libraries," and to load jQuery it hands you a <script> from ajax.googleapis.com. But every snippet loads from a Google domain, and Google's domains are among the hosts the Great Firewall most consistently impairs. In 21YunBox's census from inside the mainland the Hosted Libraries site returned no first byte across three runs from a Zhangjiakou probe (2026-08-28); and a Google asset host that the datacenter probe could reach every time failed all 54 of its requests from a Beijing residential line (2026-08-30) — real visitors fare worse than a cloud probe. Because a library like jQuery is usually a render-blocking <script>, a request that never returns stops the page rather than slowing it. The fix is to remove the Google dependency and serve the files from inside the mainland, not to tunnel back to a blocked host. A separate thread sits on the site that embeds them, which still needs an ICP filing to serve the mainland. The facts below map each point.
This is a reachability and risk picture, not a legal verdict — your ICP and data position depend on what your own site serves and collects. Our China team can map the in-country delivery and ICP path with you →
What Google Hosted Libraries's documentation says, and what we measured from inside China
| Fact | Primary source |
|---|---|
Requested from a probe inside mainland China (Alibaba Cloud cn-zhangjiakou) on 2026-08-28, the Google Hosted Libraries site (developers.google.com/speed/libraries) returned no first byte in three of three runs, each abandoned at the sixty-second limit — not a slow load, no response at all. The libraries themselves load from ajax.googleapis.com, Google's own infrastructure under the same Great Firewall treatment, so a page that pulls jQuery or any library from that host risks a render-blocking request that never returns — the page stops rather than slows. | 21YunBox — China delivery census, measured from inside mainland China (Alibaba Cloud cn-zhangjiakou), 2026-08-28 |
A datacenter probe is not a mainland visitor. In the same census, the Google Fonts stylesheet endpoint on fonts.googleapis.com — a Google asset host in the same googleapis.com family as the library host — answered every request from the Alibaba Cloud probe, yet failed all 54 of its requests when the identical measurement ran on a Beijing China Mobile residential line on 2026-08-30. Real visitors fare worse than a cloud probe, so a Google asset host that looks reachable from a datacenter can be unreachable for the people you actually serve. Confirm the specific host you depend on from a real-visitor vantage inside China. | 21YunBox — China delivery census, datacenter vs Beijing residential line, 2026-08-30 |
In Google's own words, Hosted Libraries is "a stable, reliable, high-speed, globally available content distribution network for the most popular, open-source JavaScript libraries." To load jQuery its docs hand you <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js"></script> — every library loads from ajax.googleapis.com, a Google domain. These are public library files, not your users' data, so the China question is reachability, not PIPL — and the honest catch is that "globally available" has a mainland-China exception, because Google's domains are heavily impaired behind the Great Firewall. | Google for Developers — Hosted Libraries, retrieved 2026-10-08 |
| A public-facing website shown to mainland-China visitors from inside the mainland requires an ICP filing (ICP 备案) under the State Council's Order No. 292 and MIIT's Order No. 33, tied to a hosting resource inside the mainland. That duty falls on your site — the one embedding these libraries — not on the library CDN: a public, front-end asset host carries no ICP filing of its own, and the very fix for the reachability problem, serving the files from inside China, is what brings your delivery into that filing's scope. | PRC Regulations on Telecommunications (State Council Order No. 292); Administrative Measures for the Filing of Non-operational Internet Information Services (MIIT Order No. 33) |
| Loading a library from Google Hosted Libraries delivers JavaScript files — public, open-source code, not your users' personal information — so fetching them is not itself a cross-border transfer of personal data. China's Personal Information Protection Law governs the transfer and storage of personal information, so the PIPL and data-residency questions belong to your own site's user-data flows — its forms, logins, analytics and storage — not to fetching a script. Bolting a data-residency story onto a public library CDN would be inaccurate; the real exposure here is reachability. | PIPL Chapter III, Articles 38–43 and Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
Sources verified by the 21YunBox compliance team on 2026-10-08.
For a China-facing site, the useful question about Google Hosted Libraries is a blunt, practical one: do the libraries actually load? Google Hosted Libraries is a public content delivery network for open-source JavaScript — you drop a <script> into your page and the browser fetches jQuery, D3 or another library from Google’s own host. Those are public library files, not your users’ data, so loading them is neither a cross-border transfer of personal information nor something that carries an ICP filing of its own. The exposure is reachability, and here it is unusually sharp: every file loads from ajax.googleapis.com, a Google domain, and Google’s domains are among the hosts the Great Firewall treats worst — frequently impaired, throttled or unreachable from inside the mainland. When a render-blocking library never arrives, the page waiting on it does not merely slow; it can stop. The one compliance thread runs through the site that embeds the libraries: it still has to be ICP-filed and served from inside the country.
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js"></script>. Every snippet loads from ajax.googleapis.com — a Google domain — and Google's domains are heavily impaired behind the Great Firewall, so that “globally available” network has a mainland-China exception. Source: developers.google.com/speed/librariesGoogle Hosted Libraries in China at a glance
| What decides it | What it means in China |
|---|---|
| What it is | A public CDN for open-source JavaScript libraries — jQuery, D3 and the like. You embed a <script> and the browser fetches the library from Google's host. Public code, not user data, so the China question is reachability, not PIPL. |
| Where it loads from | Google's own domain, ajax.googleapis.com (the googleapis.com family). Google runs no serving infrastructure inside mainland China. |
| Reachable from the mainland? | This is the crux — and not a neutral “offshore is slow” case. Google's domains are heavily impaired behind the Great Firewall, so these requests frequently fail or hang. In 21YunBox's census from inside the mainland (Zhangjiakou probe, three runs, 2026-08-28) the Hosted Libraries site returned no first byte on any run. |
| Data residency / PIPL | Not triggered by Hosted Libraries itself: it moves library code, not personal data. The cross-border-transfer question belongs to whatever your own site does with user data, elsewhere. |
| ICP filing | Not on the library CDN — a front-end asset host carries none. The ICP duty sits on the site that embeds the libraries, which must be filed and hosted in-country to serve the mainland. |
A CDN for open-source library code — a reachability question, not a data one
Google’s Hosted Libraries page points you straight at a hosted <script>: to add jQuery you embed a single tag that pulls the library from ajax.googleapis.com at load time. That shapes how you should judge it for China. It moves open, front-end code — library files — not personal information, so there is no cross-border transfer of personal data to clear and no ICP filing attached to the library CDN. Claiming otherwise — bolting a data-residency story onto a public code host — would not be honest. The question that actually bites is whether those files can be fetched, every time, from inside the mainland. And unlike a generic offshore CDN, this one has a specific, well-understood problem: the host is Google’s.
Served from Google’s own domains — the host the Great Firewall treats worst
However you pull a library — the jQuery snippet Google’s docs recommend, or any other entry on its list — the file arrives from ajax.googleapis.com, Google’s own infrastructure. That single fact is what sets Google Hosted Libraries apart from an ordinary offshore CDN. Google’s domains are not merely distant; they are among the hosts China’s Great Firewall most consistently impairs, so from inside the mainland requests to them frequently fail, hang, or are refused outright.
Here we do have first-party evidence, and it is about reachability, not speed. In 21YunBox’s census from inside the mainland — an Alibaba Cloud probe in Zhangjiakou, three runs on 2026-08-28 — the Hosted Libraries site on developers.google.com returned no first byte on any run, each attempt abandoned at the sixty-second cap: not a slow load, no response at all. And because a mainland cloud probe is not a mainland visitor, the sharper number comes from a real consumer line: the Google Fonts stylesheet endpoint on fonts.googleapis.com, which that datacenter probe could reach every time, failed all fifty-four of its requests when the same measurement ran on a Beijing residential line on 2026-08-30. The people you actually serve fare worse than a datacenter, so treat any Google asset host as unreliable for the mainland and confirm the specific host you depend on from a real-visitor vantage. Firewall behavior shifts over time, which is one more reason to verify current reachability rather than assume it.
The mechanism is the second half. A library like jQuery is usually loaded as a render-blocking <script>: the browser waits for it before running the code that depends on it. A request that is merely slow delays the page; a request that never returns stops it — an empty page, a spinner that never resolves, or interactive features that never initialize. And a request to a host that will not answer is not made to answer by changing where it is sent from; the only reliable fix is to change the destination. That means taking Google out of the path: serve the same library files from inside the mainland — self-hosted from your own origin, or delivered from a China-reachable, ICP-filed path — rather than reaching back across the border to a blocked Google host. It is a dependency to remove, not to tunnel around.
The compliance line falls on your site, not on the library CDN
Reaching the compliance door here means being precise about where it sits. The library CDN needs no ICP filing — but the public site that embeds it does. A website shown to mainland visitors turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, tied to a hosting resource physically inside the mainland; and if that site collects personal information from Chinese users, the cross-border transfer and data-residency rules of the Personal Information Protection Law apply to that site’s own data flows (PIPL Articles 38–43 and 40; Cybersecurity Law Article 39 (formerly Article 37)). The Google-hosted libraries carry no personal data and sit inside none of that — but there is an overlap worth noticing: the very move that fixes the reachability problem, serving the files from inside China, is what puts your delivery onto an in-country, ICP-filed footing. Removing the Google dependency and standing on a lawful in-country base turn out to be the same step.
This is a reachability and risk map, not a verdict: whether a blocked library host merely degrades your site or leaves it broken, and whether your own hosting and data position is sound, depends on how your front-end is built and what you collect — worth settling with counsel and a look at your real dependencies.
Where 21YunBox fits — a compliant overlay, not a migration
You do not swap out jQuery or rewrite your front-end. What we remove is the Google dependency: the same library files your pages reference from ajax.googleapis.com are delivered from ICP-filed infrastructure inside the mainland, set in front of the origin you already run — no rebuild, no forked codebase, and no circumvention of the firewall. Instead of mainland browsers reaching across the border to a Google host that often will not answer, they load the libraries from inside the country. Alongside that, our China team looks at the piece a library CDN can never cover for you: whether the site serving those files is itself ICP-filed, hosted in-country, and sound on PIPL for the user data it collects. Your <script> tags keep naming the libraries they always did; what changes is that the bytes no longer come from a blocked Google domain.
Related reading:
