Does IPinfo Work in China? Data Residency, ICP & Cross-Border Rules

IPinfo resolves IP addresses to location and network context. A China user's IP is personal information, so calling its hosted API sends it offshore — a PIPL cross-border transfer. The residency lever: IPinfo ships downloadable databases you can query in-country, so IPs never leave the mainland.

By the 21YunBox Compliance Team · Reviewed 2026-10-13 · Verified against IPinfo's own documentation

Does IPinfo work in China?

Mostly yes — but reachability isn't the question. IPinfo resolves an IP address to location and network context, and a China user's IP is personal information, so what decides compliance is whether that IP ever leaves the mainland. Call IPinfo's hosted API and every China user's IP is handed to an offshore service — a cross-border transfer of personal information under PIPL Articles 38–40.

The residency lever is that IPinfo ships downloadable databases — MMDB, CSV, JSON, and Parquet — that you can host and query in-country. Resolve IPs from a local copy on mainland infrastructure and no China user's IP crosses the border, turning a cross-border problem into an ordinary in-country lookup. Where a resolved precise location is used to track an individual's whereabouts, it can be sensitive personal information under PIPL Article 28, needing separate consent.

21YunBox maps what you send to IPinfo and where it resolves, localizes resolution to a database running in-country, and delivers your China-facing app and API in-country on ICP-filed infrastructure — no rebuild, and never any form of circumvention. Treat the specifics as a risk to confirm with counsel.

What IPinfo's own documentation says about China

Fact	Primary source
IPinfo ships downloadable databases for offline, self-hosted use. IPinfo's database-download page states: “Our IP address database downloads give you full control over how and where you use IP data,” offered for “complete offline access” in MMDB, CSV, JSON, and Parquet — so resolution can run on infrastructure you control, including in-country.	IPinfo, “IP Address Database Downloads” (ipinfo.io), retrieved 2026-10-13
The hosted API is a per-request lookup; the downloads are the local alternative. IPinfo positions the datasets for when “APIs are not always enough,” noting that “When scale, latency, or security is critical, direct database downloads give you full control.” A call to the hosted API resolves each IP on IPinfo's own servers; we found no mainland-China region for it (an inference to confirm with IPinfo).	IPinfo, “IP Address Database Downloads” (ipinfo.io), retrieved 2026-10-13
Sending a China user's IP to an offshore service is a cross-border transfer. An IP address is personal information where it relates to an identifiable person, so handing it to an offshore third party to resolve triggers PIPL's cross-border rules — notice, a separate consent, and one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification) — and providing it to a third party also engages PIPL Article 23.	PIPL cross-border transfer rules (Articles 38–40) — 21YunBox explainer, retrieved 2026-10-13
An IP is personal information, and a resolved precise location can be sensitive. Under the Personal Information Protection Law, information relating to an identifiable person is personal information, and whereabouts data is sensitive personal information (Article 28) needing separate consent (Article 29), on top of a lawful basis to process (Article 13). For a critical information infrastructure operator, Cybersecurity Law Article 39 (formerly Article 37) adds an in-country storage duty.	Personal Information Protection Law (PIPL) — 21YunBox explainer, retrieved 2026-10-13

Sources verified by the 21YunBox compliance team on 2026-10-13.

For a product that serves mainland China, the first question about IPinfo is not whether the service loads or whether your servers can reach it — they can. IPinfo is an IP data provider: you give it an IP address and it returns geolocation, ASN, company, carrier, and related network context. The question that actually decides compliance is what you are doing with your China users’ IP addresses, and where those addresses are resolved. An IP address is an online identifier that, on its own or combined with other data, points to a person, so under China’s law it is treated as personal information — and the moment you hand a China user’s IP to a service sitting outside the mainland, you have moved personal information across the border. That makes IPinfo a data-residency question, not a speed test.

IPinfo's IP Address Database Downloads product page, showing that the datasets are offered for offline, self-hosted use in MMDB, CSV, JSON, and Parquet formats so resolution can run on infrastructure you control — IPinfo's own database-download page states: “Our IP address database downloads give you full control over how and where you use IP data.” Because the datasets download for “complete offline access” in MMDB, CSV, JSON, and Parquet, resolution can run on infrastructure you control — including in-country — which is the residency lever. Source: ipinfo.io — IP Address Database Downloads

IPinfo in China at a glance

What decides it	In IPinfo's own terms — and China's law
What you send, and where it resolves	IPinfo's core product is a hosted lookup: you call its API with an IP address and it resolves that address on IPinfo's own servers. We found no mainland-China region for the hosted API (an inference to confirm with IPinfo), so a call made for a China user resolves offshore. IPinfo also ships downloadable databases — in its own words, for “complete offline access” — which run wherever you load them, including on mainland infrastructure.
A China user's IP is personal information	An IP address is an online identifier that relates to an identifiable person, so it is personal information under the Personal Information Protection Law. When you resolve it into a precise location used to track where an individual is, that output can be sensitive personal information under PIPL Article 28, which requires a separate consent (Article 29) on top of a lawful basis to process (Article 13).
Calling the hosted API = a cross-border transfer	Passing a China user's IP to IPinfo's offshore API hands personal information to a third party outside the mainland. That is a cross-border transfer (数据出境) under PIPL Articles 38–40: notice, a separate consent, and one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification — and providing it to another handler also engages PIPL Article 23.
In-country storage, where it applies	For a critical information infrastructure operator — and, at the volumes the Cyberspace Administration of China specifies, a large-volume handler — personal information collected in the mainland must be stored in the mainland under PIPL Article 40 and the Cybersecurity Law Article 39 (formerly Article 37); the 2025 amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39 (substance unchanged).
Reachability isn't the axis — the lawful path	That IPinfo's API answers quickly from the mainland changes nothing: the IP still crosses the border when it is resolved offshore. Because IPinfo ships a downloadable database, the lawful path is to resolve in-country from a local copy so no China user's IP leaves the country, and to put any China-facing surface in front of it on ICP-filed delivery.

Where the resolution actually happens

IPinfo’s position in China is set by where an IP gets resolved, not by a load-time test. Its default product is a hosted lookup — you call the API with an address, and IPinfo returns the geolocation and network context from its own infrastructure. IPinfo itself frames the downloadable databases as the alternative for when the hosted path is not enough: its database-download page says plainly that “APIs are not always enough,” and that “When scale, latency, or security is critical, direct database downloads give you full control.” We could not confirm a mainland-China region for the hosted API, so a call made on behalf of a China user resolves outside the mainland; treat that as an inference to verify with IPinfo for your account.

The downloadable databases are a different map, and they are the good news. IPinfo offers them for “complete offline access” in MMDB, CSV, JSON, and Parquet, and states that the downloads “give you full control over how and where you use IP data.” That control over where is exactly the residency lever: the same dataset resolves identically whether it is loaded offshore or on mainland-China soil, so you can host a local copy in-country and look up your China users’ IPs against it without any address leaving the country. Because of this, the familiar “does the API respond from Shanghai?” test is the wrong question — which is why this page publishes no first-party China latency figure for IPinfo; speed is not the axis for data that should never have crossed the border. See our explainer on cross-border data transfers under PIPL.

What you send is personal information

The input to IPinfo is the part that carries the compliance weight. An IP address is an online identifier: on its own, or combined with the other signals an application already holds, it relates to an identified or identifiable natural person, which makes it personal information under China’s Personal Information Protection Law. Resolving, logging, and enriching that address is therefore the processing of personal information, and when the resolved output is a precise location used to follow where a person is, that whereabouts data is sensitive personal information under PIPL Article 28 — it needs a separate, specific consent under Article 29, in addition to the lawful basis every processing act requires under Article 13.

Handing that IP to IPinfo is also a disclosure to a third party. Where the resolution happens on an offshore service, two duties stack: providing personal information to another handler engages PIPL Article 23 (notice and a separate consent), and moving it out of the mainland engages the cross-border rules in PIPL Articles 38–40 — notice, a separate consent, and one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification). For a critical information infrastructure operator, or a handler at the volumes the Cyberspace Administration of China specifies, personal information collected in the mainland must also be stored in the mainland under PIPL Article 40 and the Cybersecurity Law Article 39 (formerly Article 37) — a duty an offshore lookup structurally cannot meet.

Reachability isn’t the axis — and the residency lever

A reachability check — does api.ipinfo.io answer, and how fast — misses all of this, because it measures the wrong thing. The question China’s law asks is not whether the endpoint responds; it is whether a China user’s personal information left the country, and under what basis. An offshore API that answers in milliseconds has still taken the IP across the border on every call. Making that endpoint merely reachable does not cure the transfer; it just makes the unlawful pattern faster.

The lever is that IPinfo does not force you onto the hosted path. Because it ships the same dataset as a downloadable database — MMDB, CSV, JSON, or Parquet, for offline use — you can resolve IPs in-country from a local copy, so the address is enriched on mainland infrastructure and never handed to an offshore service. That turns a cross-border transfer into an ordinary in-country lookup, and it narrows what you send to the minimum: you keep the raw China-user IPs on mainland soil and let only the aggregated or de-identified results that may lawfully leave go offshore. None of this is a verdict on your specific situation — whether you are a critical information infrastructure operator, which volume thresholds you cross, which transfer mechanism applies, and whether any transfer is lawful at all are questions to settle with your counsel against the data you actually handle and the entity that handles it.

The lawful path — map, localize, deliver

There is a lawful, durable way to use IPinfo for users in China, and it keeps the shape of your stack intact. 21YunBox is a compliant overlay, not a migration — and a partner to the platform you already run, not a competitor. Our China team works in three moves. We map your exposure: what you send to IPinfo and what you resolve, the PIPL consent basis for an IP and for any precise location you derive, the cross-border question, the transfer mechanism, the in-country storage duty for critical information infrastructure operators and large-volume handlers, and the ICP filing (备案) obligation on any China-facing surface — read against your entity, your data volumes, and whose personal information you handle. We localize resolution by running IPinfo’s downloadable database in-country — loaded on mainland infrastructure so your China users’ IPs are enriched locally and never leave the country; localize means standing up a lawful in-country lookup, never a route back to an offshore endpoint. And we deliver every China-facing surface in front of it — the application, the API edge, the admin and reporting portals your mainland users reach — in-country over ICP-filed infrastructure, the 21YunBox Optimizer, in front of the stack you already run, with no rebuild and no second codebase. The result runs legally and compliantly for your users in China. 21YunBox never uses or suggests circumvention of any kind.

Get a compliance assessment →

Related reading:

Frequently Asked Questions

Can I use IPinfo for China users without sending their IPs abroad?

Yes — through the downloadable database. IPinfo ships its datasets as downloadable files (MMDB, CSV, JSON, Parquet) for offline use, so if you load a local copy on mainland-China infrastructure and resolve IPs against it, the China user's IP never leaves the country and there is no cross-border transfer to IPinfo. The hosted API is the opposite: it sends each IP to IPinfo's own servers to resolve. Which path you are on — and whether the rest of your setup is compliant — is a risk to confirm with counsel.

Is a China user's IP address really personal information under PIPL?

Treat it as such. PIPL covers information relating to an identified or identifiable natural person, and an IP address is an online identifier that — alone or combined with other data an app holds — can point to an individual, so resolving, logging, and enriching it is the processing of personal information. Where you resolve it into a precise location that tracks where someone is, that output can be sensitive personal information under Article 28, which needs a separate consent under Article 29. Confirm your exact obligations with counsel.

Doesn't it work if the IPinfo API just loads fast from China?

Speed is not the test. Even if IPinfo's API answers quickly from the mainland, calling it still sends each China user's IP to an offshore service, which is the cross-border transfer the law regulates; making an offshore endpoint merely reachable does not make the transfer lawful. Resolving in-country from a local copy of the downloadable database does. 21YunBox maps the exposure, localizes resolution in-country, and delivers the China-facing surface on ICP-filed infrastructure — never any form of circumvention.