Does Joomla Work in China? ICP Filing, Data Residency & Visitor-Data Rules
Joomla is a free, open-source (GPL) self-hosted PHP CMS, so you can run it in-country in mainland China — the lawful path. A China-facing site needs an ICP filing bound to mainland hosting, and the visitor data it collects must stay in-country, a PIPL matter if the CMS is hosted offshore. A compliance-first look at the ICP, hosting-residency and visitor-data path.
Does Joomla work in China?
Because Joomla is a self-hostable open-source CMS, it CAN run in China lawfully — but a China-facing site needs an ICP filing bound to mainland hosting, and the visitor data it collects must stay in-country, which is a PIPL cross-border matter if the CMS is hosted offshore.
Joomla is a free, open-source (GPL) PHP CMS you download and host yourself — so it holds your content plus the personal information your site collects from mainland visitors: registered-user accounts, contact-form submissions, comments and analytics. The public China-facing site is an internet information service, so an ICP filing bound to a mainland hosting resource is the lead door; self-hosting in-country is your residency lever; and keeping the CMS offshore turns that visitor data into a cross-border transfer under PIPL. The lawful lever is to host Joomla in-country, ICP-file the site, and keep the visitor data in the mainland — not to make an offshore site reachable.
This is a risk map, not a verdict — which duties bite turns on your entity, your data and who your users are. Our China team can map your exposure →
What Joomla's own documentation says about China
| Fact | Primary source |
|---|---|
| Joomla is a free, open-source CMS you host yourself. On its own About page Joomla states it is "a free and open-source content management system (CMS) for publishing web content," that it is "based on PHP and MySQL," and — for teams running it themselves — invites you to "install Joomla! by yourself" by downloading the package. Because you choose where it runs, an in-country, compliant deployment is achievable. | Joomla — About / What is Joomla? (joomla.org/about-joomla.html), retrieved 2026-10-11 |
| Joomla is GPL-licensed, so where you deploy it is your decision. Joomla's About page states it is "free, open, and available to anyone under the GPL license" — there is no vendor-fixed region and no managed-only lock-in. That open, self-hostable design is the residency lever: deploy Joomla on China-resident infrastructure and the content and visitor data stay in the mainland by design. | Joomla — About / What is Joomla? (joomla.org/about-joomla.html), retrieved 2026-10-11 |
| A public mainland website is an internet information service and needs an ICP filing. Serving a site to the public in mainland China triggers an ICP filing (ICP 备案) duty under State Council Order No. 292 and MIIT Order No. 33, and the filing must attach to a hosting resource inside the mainland. A Joomla site you host in-country gives you a mainland resource to file against; an offshore-hosted site has none. | 21YunBox — China ICP filing guide; State Council Order No. 292; MIIT Order No. 33, retrieved 2026-10-11 |
| Offshore-hosted visitor data is a cross-border transfer, with in-country storage for some handlers. The user, form, comment and analytics data a Joomla site collects from people in China is personal information; hosting the CMS offshore makes collecting it there a cross-border transfer under PIPL (Articles 38–40, with the Article 13/23 notice-and-consent). For a CIIO or large-volume handler, personal information generated in China must be stored in the mainland (Cybersecurity Law Article 39 (formerly Article 37); PIPL Article 40). | 21YunBox — Cross-border data transfers & China's Cybersecurity Law; PIPL Articles 13, 23, 38–40; Cybersecurity Law Article 39 (formerly Article 37), retrieved 2026-10-11 |
Sources verified by the 21YunBox compliance team on 2026-10-11.
Whether Joomla “works” in mainland China is not a question you answer with a stopwatch. Joomla is a free, open-source content management system — in its own words, “a free and open-source content management system (CMS),” “based on PHP and MySQL” and “available to anyone under the GPL license” — and the decisive thing about it is that you download it and host it yourself. That makes the China question a constructive one: because Joomla is self-hostable, you can deploy it in-country, so a lawful mainland deployment is achievable rather than off the table. What the answer turns on is compliance, not load speed. The public China-facing site is an internet information service that needs an ICP filing bound to mainland hosting (the lead door); self-hosting is your residency lever; the visitor data the site collects becomes a cross-border transfer if Joomla is hosted offshore; and even in-country, the site still needs compliant delivery. Joomla’s own About page sets out the posture that makes this achievable.
Joomla in China at a glance
| What decides it | In Joomla's own terms — and China's law |
|---|---|
| What it holds | Your published content, menus and templates, plus the administrator and author accounts your team signs in with — and the personal information a public site gathers: registered-user accounts and profiles, contact-form submissions, article comments, and the cookies and analytics behind the pages. Wherever your Joomla instance runs, all of it lives there too. |
| Where it runs (the lever) | Your choice. Joomla is "a free and open-source content management system (CMS)," "based on PHP and MySQL" and "available to anyone under the GPL license" — you download it and install it on infrastructure you control, mainland China included. That self-hostable design is the residency lever: an in-country, compliant deployment is achievable, not blocked. |
| ICP filing (the lead door) | A website served to the public in mainland China is an internet information service, so it carries an ICP filing (ICP 备案) duty bound to a hosting resource physically inside the mainland. A Joomla site you host in-country gives you a mainland resource the filing can bind to; a site left on offshore hosting has none and cannot be filed. |
| Visitor data: residency & cross-border | The registered-user, contact-form, comment and analytics data your site collects from mainland visitors is personal information. Host Joomla offshore and collecting it there is a cross-border transfer you make as the handler — PIPL Articles 38–40, with the Articles 13/23 notice-and-consent and cookie consent. For a critical information infrastructure operator or a large-volume handler, that data must be stored in the mainland (Cybersecurity Law Article 39 (formerly Article 37); PIPL Article 40). |
| Is it reachable? (not the axis) | There is no Joomla-operated endpoint for the border to interrupt — a self-hosted Joomla answers from wherever you deploy it, so reachability is a consequence of the hosting decision, not the China question. The axis is the ICP filing, where the visitor data lives, and compliant in-country delivery in front of the Joomla you run. |
What it actually holds — your content and your visitors’ data
Joomla is the software behind the site, but “the site” is more than the words on the page. A Joomla install holds your published articles, menus and templates; the administrator and author accounts your team signs in with; and — the part China’s law cares most about — the personal information the public site gathers from the people who visit it. A registration-and-login site keeps user accounts and profiles; a contact form writes submissions to the database; comments carry names, email addresses and IP addresses; and the cookies, tracking and analytics behind the pages build behavioral records. All of it is stored wherever the Joomla instance runs.
And where it runs is your decision, not a vendor’s. Joomla is open source under the GPL, “based on PHP and MySQL,” and something its own documentation invites you to “install Joomla! by yourself”: you download the package and deploy it on hosting you control. With a managed SaaS the provider fixes the region and you live with it; with Joomla the location is yours to set, mainland China included. That single property is why the China story here is constructive rather than a dead end.
The doors: ICP, self-hosting as the residency lever, and visitor data
Three doors decide a Joomla site’s China posture, and for a public site the first is the sharpest.
ICP filing — the lead door. A website or app served to the public in mainland China is an internet information service, and that triggers an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33. The filing must attach to a hosting resource physically inside the mainland — which is exactly why hosting matters. A Joomla site you run on China-resident infrastructure gives you a mainland resource the filing can bind to; a site left on an offshore platform or VM has nothing on Chinese soil to file against and cannot be filed. “We already run Joomla” does not carry into China on its own.
Self-hosting is your residency lever. Because Joomla is open source and self-hostable, the compliance path a managed “no China region” product cannot offer is open to you: deploy the CMS in-country, and the content and the visitor data stay in the mainland by design. The risk is the default, not the ceiling — teams run Joomla on an offshore managed host, and then the data their China site collects is processed and stored abroad. Moving the deployment in-country is what closes that gap.
Visitor data — residency and cross-border. The registered-user accounts, contact-form submissions, comments and analytics your Joomla site collects from people in mainland China are personal information, and you are the handler. Keep the CMS offshore and collecting that data there is a cross-border transfer under the Personal Information Protection Law: notice and a separate consent for the overseas transfer (Articles 13 and 23), and one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification (Articles 38–40). And for a critical information infrastructure operator or a large-volume handler, the Cybersecurity Law’s Article 39 (formerly Article 37 — the 2025 Cybersecurity Law amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39, with its substance unchanged) requires personal information generated in China to be stored in the mainland — a duty no offshore deployment can meet. Which of these bind your project is a risk to settle with counsel against what your site actually collects.
Loading isn’t the question — a compliant, ICP-filed in-country site is
It is tempting to reduce “does Joomla work in China” to whether the homepage paints quickly for a visitor in Shanghai. That is the wrong axis. A self-hosted Joomla has no vendor endpoint at the border to interrupt; it answers from wherever you put it, so speed is a downstream effect of the hosting decision, not the thing that decides compliance. Reaching a server from the mainland is not the same as being cleared to operate a mainland site.
The lawful shape is straightforward, and self-hosting is what makes it reachable: host the Joomla instance in-country, file the public site’s ICP against that mainland hosting resource, and keep the registered-user, form, comment and analytics data in the mainland. The fix is to move what must stay home onto a China-resident path and deliver it compliantly in-country — never to tunnel an offshore site into the mainland. None of this says Joomla is “blocked” or “illegal”: it is self-hostable software, and much of the exposure dissolves the moment you choose an in-country deployment. This page is a risk map, not a verdict — which duties bite turns on your entity, your data, your role under Chinese law and who your users are, so settle the specifics with counsel before you build.
The lawful path — map, localize, deliver
There is a compliant way to run Joomla for a China-facing audience, and because Joomla is self-hostable, its middle step is unusually clean.
First, map: our China team inventories what your site collects from mainland visitors — registered accounts, contact-form submissions, comments, cookies and analytics — where the Joomla instance is hosted today (often an offshore platform or VM), the ICP status of the China-facing domain, and the consent and residency basis you rely on. We build the technical picture; the legal conclusions are settled with counsel.
Then localize: this is where Joomla’s open design pays off. We stand up and integrate a self-hosted Joomla on China-resident, ICP-filed infrastructure, so the content, the admin accounts and the visitor data stay in the mainland by design — and we put the Article 13/23 notice-and-consent and cookie consent in place and handle any CIIO or high-volume storage duty. Localize means keeping the data and the site on an in-country path — never a tunnel. You keep your offshore instance for the markets it already serves; the China entity runs its own in-country Joomla.
Then deliver: the public China-facing site is a mainland service, so it carries an ICP filing duty bound to a mainland hosting resource, plus compliant, reliable in-country delivery — the 21YunBox Optimizer, set in front of the Joomla you already run, with no rebuild and no re-platform. The result is a Joomla-backed site that runs legally and compliantly for your users in China. 21YunBox never uses or suggests circumvention of any kind. We localize what must stay in-country and deliver it in the mainland — a compliant overlay in front of the CMS you already run, never a tunnel out of it.
Related reading:
- How to get an ICP filing for your China website
- Cross-border data transfers under PIPL
- China’s Personal Information Protection Law (PIPL)
- China’s Cybersecurity Law (data localization, Article 39)
