Does Iterable Work in China? PIPL Cross-Border, Delivery & Data Residency

For a product that sends push, email, SMS or in-app messages to users in mainland China, the first question about Iterable is usually whether its API and SDKs can be reached. They can — so reachability is not where the China decision is made. It turns on what happens when you hand Iterable your China users’ identifiers and message content to deliver. Iterable is a cross-channel engagement platform: you upload device push tokens, user IDs, email addresses and phone numbers, profile attributes and events, and its segments and journeys decide who receives which message, then deliver it — all processed in Iterable’s US or EU (Ireland) data centers, with no mainland-China region. On China users that is at once a PIPL cross-border transfer of personal information and content (Articles 38–40, 数据出境); an Android delivery-channel door, because Iterable’s push rides Firebase Cloud Messaging, unavailable on most mainland Android devices; a marketing-consent duty (Articles 13 and 23); Article 24 profiling where segments decide who gets what; and, for a CIIO or high-volume handler, in-country storage.

Iterable in China at a glance

What you actually send — recipient identifiers, profiles and content

An engagement platform is not a passive pipe. To send a push notification, an email or an SMS to someone in Shanghai, you first give Iterable the raw materials: that person’s device push token or address, a user ID, often an email and phone number, and the profile attributes and behavioral events you have collected — then the message content itself. Iterable stores those profiles and events to build audiences, which is the point of the product: its segments and journeys target and time each message from the data you have loaded. So Iterable does not merely relay a message; it accumulates a persistent, queryable store of who your China users are and what they do.

That store, and the processing around it, live offshore. Iterable’s own documentation describes two data centers — a US data center and a European data center in Ireland — and states that “Most Iterable customers use Iterable’s US data center,” with each organization’s projects hosted entirely “in the US, or all in the EU.” Its published sub-processor list places its infrastructure (Amazon Web Services) and its email and SMS delivery providers in the United States, Ireland and Germany. None of that is in mainland China. The device tokens, contact details, profiles, message content and engagement events your China-facing program generates sit on that offshore infrastructure for as long as Iterable holds them — and that retained, offshore personal information is what China’s law weighs, not how quickly the API answers.

It’s a cross-border transfer — and Android delivery has its own door — under PIPL

Here is the gate most teams miss. The device tokens, email addresses, phone numbers, profile attributes and message content Iterable holds for your users in China are personal information — and once they sit on infrastructure in the United States or Ireland, you have made a cross-border transfer (数据出境) out of the mainland. China’s Personal Information Protection Law puts the duty on the handler — you, not Iterable: Articles 38–40 require notice to the individual, a separate consent distinct from any agreement to receive your messages, and one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification. Delivery receipts, opens, clicks and the engagement profile then persist offshore.

Two further duties ride on top. Promotional or marketing push carries a lawful-basis-and-consent obligation of its own (PIPL Articles 13 and 23), and the recipient’s opt-out must be honored. And because Iterable’s segments and journeys decide who receives which message from a behavioral profile, PIPL Article 24 — automated decision-making — applies: the decision must be transparent and fair, and the individual must be able to refuse decisions made by profiling of their personal characteristics.

Then the distinctive second door: delivery itself. Iterable’s Android push runs on Firebase Cloud Messaging, and FCM depends on Google Play Services, which is absent from most mainland-China Android devices — so FCM-only push is unreliable or undeliverable to those users, and Iterable’s own documentation describes no Chinese manufacturer push channel. Reaching Chinese Android users lawfully and reliably means routing through each device manufacturer’s own push service — Xiaomi, Huawei (HMS), OPPO, vivo, Honor — each a licensed in-country channel requiring a registered app and credentials, and increasingly app and content filing. This is the push counterpart of SMS signature-and-template licensing: a lawful in-country delivery requirement, not a reachability setting. Apple’s APNs does operate in China through Apple’s local entity, so iOS push is deliverable — but the token and content still cross the border, so the transfer analysis above still applies.

Residency can bite last. Above certain volumes, or where the data is “important data,” the transfer may require China’s data-export security assessment (数据出境安全评估) before anything leaves. And if your organization is a critical information infrastructure operator, the Cybersecurity Law’s Article 39 (formerly Article 37 — the 2025 Cybersecurity Law amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39, substance unchanged) requires personal information collected and generated in China to be stored in China — an in-country duty no US or EU region can meet.

Reaching the SDK isn’t the question — lawful in-country delivery is

None of this is a latency problem, so none of it is solved by making the offshore endpoint faster or more reachable. The exposure is that the recipient data and the delivery both sit offshore; the lawful answer is to bring both onto an in-country path.

Concretely, that means routing your Chinese Android push through the licensed in-country manufacturer channels instead of relying on an FCM path that cannot reach those devices; keeping the recipient data — tokens, contact details, profiles and events — on an in-country footing, minimized and pseudonymized so the least identifying data crosses the border; holding the Article 13/23 consent for anything promotional and honoring the Article 24 right to a non-profiled option; or, where residency or volume demands it, routing China traffic through a licensed in-country engagement alternative. This is a governed, in-country delivery path — never a tunnel that ships the same data offshore under another name.

Which of these duties apply to your program, and in what combination, depends on what recipient data and content you send, whether you profile to target, your data volumes, and who your users are — worth settling the specifics with counsel before you build. This page is a risk map, not a verdict.

The lawful path — map, localize, deliver

You keep running Iterable. 21YunBox adds the piece its offshore service cannot, as a compliant overlay in front of the stack you already run — no rebuild, no migration.

• Map — our China team inventories what recipient identifiers, profile attributes and message content your Iterable programs send offshore, what personal information each carries, where it is processed and stored, how your Chinese Android push is delivered today (an FCM path that silently fails versus licensed manufacturer channels), the consent basis you rely on, and any Article 24 profiling.
• Localize — we keep China-user delivery and recipient data on an in-country, licensed path: Chinese Android push routed through the licensed in-country manufacturer channels, APNs tokens and content governed, the data minimized and pseudonymized, the marketing consent held and the Article 24 opt-out honored — or China traffic routed through a licensed in-country engagement alternative where residency demands it. 21YunBox never uses or suggests circumvention of any kind.
• Deliver — the app or site that triggers the notifications carries an ICP filing duty and needs compliant, in-country delivery — the 21YunBox Optimizer, placed in front of your existing origin, so a mainland audience is served lawfully without moving off your global stack.

The result is Iterable that runs legally and compliantly for your users in China, with delivery and the recipient data behind it on an in-country footing. Where any telecom or push-licensing question touches the arrangement, that sits with a licensed in-country operator and your counsel — 21YunBox is advisory there.

Get a compliance assessment →

Related reading:

• Cross-border data transfers under PIPL
• China’s Cybersecurity Law (data localization, Article 39)
• China’s data-export security assessment
• How to get an ICP filing for China

RELATED TECHNOLOGIES

Ably

Ably

Braze

Braze

Firebase Cloud Messaging

Firebase Cloud Messaging

OneSignal

OneSignal

Pusher

Pusher