Does jQuery CDN Work in China? Reachability, the ICP Line & a Cross-Border Request Leak
jQuery's CDN (code.jquery.com) serves the library from Fastly's offshore global network — jQuery migrated to Fastly from StackPath in 2023 — with no point of presence inside mainland China, so a render-blocking jQuery script pulled from it can stall or break for Chinese visitors, and every request discloses the visitor's IP and user-agent to an offshore edge. The library CDN holds no ICP filing of its own; that duty, and the real data exposure, sit on the site that embeds it. A compliance-first look at reachability, the ICP line, the small cross-border leak, and the lawful in-country path.
Does jQuery CDN work in China?
For a China-facing site the jQuery CDN is a reachability question first, not a data one: jQuery serves the library from Fastly's offshore global network, with no point of presence inside mainland China, so a render-blocking script pulled from code.jquery.com can load slowly or fail — and when it fails, the page that depends on it can break.
jQuery's own infrastructure documentation says its CDN is “powered by Fastly” and that it “migrated from StackPath to Fastly” in September 2023, with origin servers at DigitalOcean — all outside the mainland. The library files are public code, not user data, so the CDN itself carries no real data-residency story; but each fetch does disclose the visitor's IP, user-agent and referer to an offshore edge, a small cross-border transfer of personal information under PIPL. The weightier duties sit one step over, on the site that embeds jQuery: a public mainland site needs an ICP filing bound to in-country hosting, and the Cybersecurity Law's Article 39 (formerly Article 37) residency duty can reach the personal data that site collects.
The fix is never a network workaround: self-host the library, or serve it from ICP-filed, in-country delivery in front of the origin you already run. 21YunBox maps the reachability and ICP exposure, localizes the dependency in-country, and delivers it compliantly — never any form of circumvention. Treat the specifics as a risk to confirm with counsel. Get a compliance assessment →
What jQuery CDN's own documentation says about China
| Fact | Primary source |
|---|---|
| jQuery's CDN is served from Fastly's offshore global network — it migrated from StackPath in 2023 — with no point of presence inside mainland China. jQuery's own infrastructure documentation states that “jQuery CDN is currently powered by Fastly,” that “In September 2023, jQuery CDN migrated from StackPath to Fastly,” and that “The origin servers (hosted at DigitalOcean) are managed by Puppet, running Debian Linux with an Nginx web server.” Fastly and DigitalOcean both answer mainland requests from across the border, so a jQuery file pulled from code.jquery.com can be slow or unreachable from inside China. | jQuery infrastructure documentation — jQuery CDN, retrieved 2026-10-09 |
| jQuery itself treats code.jquery.com as a “third-party source” your page reaches out to. On its official CDN page, jQuery explains that the integrity and crossorigin attributes are “used for Subresource Integrity (SRI) checking,” which “allows browsers to ensure that resources hosted on third-party servers have not been tampered with,” and that “Use of SRI is recommended as a best-practice, whenever libraries are loaded from a third-party source.” An offshore third-party dependency that fails to load from inside China takes the page that depends on it down with it. | jQuery — official CDN / releases page (releases.jquery.com), retrieved 2026-10-09 |
| Every request to an offshore library CDN discloses the visitor's IP, user-agent and referer across the border — a small cross-border transfer of personal information. The jQuery files carry no user data, but the request that fetches them does: an IP address and the headers that accompany it are personal information, and handing them to an edge outside the mainland is the kind of transfer PIPL governs (Articles 38–40 — notice, separate consent, and one transfer mechanism). It is modest beside a site's own forms and logins, but it is not nothing. | Personal Information Protection Law of the PRC, Articles 38–40 (cac.gov.cn), retrieved 2026-10-09 |
| The ICP and data-residency duties fall on the site that embeds jQuery, not on the library CDN. A public website served to mainland visitors turns on an ICP filing (State Council Order No. 292; MIIT Order No. 33) bound to a hosting resource physically in the mainland — which an offshore library host cannot provide — and where the embedding site is a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). | State Council Order No. 292; MIIT Order No. 33; PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37), retrieved 2026-10-09 |
Sources verified by the 21YunBox compliance team on 2026-10-09.
For a China-facing site, the useful question about the jQuery CDN is a blunt one: does the library actually arrive? The jQuery CDN is a public content delivery network for a single thing — the jQuery library itself. You drop a <script> into your page and the browser fetches jQuery from code.jquery.com while the page loads. Those are public library files, not your users’ data, so pulling them is not the kind of cross-border personal-data story that governs an analytics or consent platform. The exposure here is narrower and more operational: whether that file can be fetched, on every request, from inside the mainland — and, underneath it, whether the site serving it stands on lawful in-country footing. jQuery states where its CDN runs in its own documentation, and the answer puts the file offshore.
code.jquery.com answers mainland requests from across the border. Source: jQuery infrastructure documentation — jQuery CDNjQuery CDN in China at a glance
| What decides it | In jQuery's own terms — and China's law |
|---|---|
| What it is | A public CDN for one library — jQuery. You embed a <script> and the browser fetches the file from code.jquery.com at load time. Public code, not user data, so the China question is reachability and footing, not a data-residency story on the CDN. |
| Where it loads from | Per jQuery's own documentation the CDN is “powered by Fastly” — it “migrated from StackPath to Fastly” in September 2023 — with origin servers “hosted at DigitalOcean.” An offshore global network, with no point of presence inside mainland China. |
| Reachable from the mainland? | Answered from Fastly edges outside the country, so from inside mainland China it can be slow, throttled or unreachable. And jQuery is usually a render-blocking <script>: a fetch that hangs or fails doesn't just drag the page — it can stop the code that depends on jQuery from running, breaking it. |
| Request metadata / PIPL | The files carry no user data, but each fetch discloses the visitor's IP, user-agent and referer to an offshore edge — a small cross-border transfer of personal information under PIPL (Articles 38–40). Modest beside your own forms and logins, but not nothing. |
| ICP filing | None on the library CDN — a front-end asset host carries no filing, and an offshore one cannot hold a mainland ICP. The ICP duty sits on the site that embeds jQuery, which must be filed and hosted in-country to serve the mainland. |
Public library code — so the first question is whether it loads
jQuery’s CDN hands you a hosted <script> and nothing more: to add jQuery you reference a single file that the browser pulls from code.jquery.com as the page paints. That shapes how to judge it for China. It moves open, front-end code — a library file — not personal information, so there is no cross-border transfer of user data to clear on the CDN itself and no ICP filing attached to the library host. Bolting a data-residency problem onto a public code CDN would not be honest. The question that actually bites is plainer: can that file be fetched, reliably, from inside the mainland — and what happens to the page when it can’t? jQuery’s own documentation even frames code.jquery.com as something external you reach out to, recommending Subresource Integrity “whenever libraries are loaded from a third-party source.” For a China-facing site, an offshore third-party source is exactly the part that can go missing.
Served from Fastly’s offshore network, with no mainland presence
jQuery sets out where its CDN lives in its own infrastructure notes: the service is “powered by Fastly,” having “migrated from StackPath to Fastly” in September 2023, with the “origin servers (hosted at DigitalOcean).” Fastly runs a global edge and DigitalOcean a set of origins — and neither places serving infrastructure inside mainland China. So mainland traffic to code.jquery.com is answered from across the border, where it is subject to the usual offshore uncertainty: frequently slower, sometimes throttled, occasionally unreachable, and which of those you get moves with the route, the carrier and the time of day.
The mechanism is what makes this sharp rather than cosmetic. A library like jQuery is almost always loaded as a render-blocking <script> — the browser waits for it before running everything built on top of it. A request that is merely slow delays the page; a request that never returns can halt it, leaving an empty frame, a spinner that never resolves, or interactive features that never wake up. And a file that will not arrive is not made to arrive by changing where the request is sent from; the only dependable fix is to change the destination — to serve the same library from inside the country rather than reach back across the border for it. 21YunBox never uses or suggests circumvention of any kind; this is a dependency to relocate, not a border to work around.
A smaller thread — every request carries metadata across the border
There is one data point worth naming, even though it is the lighter half of the story. The jQuery file is public, but the request that fetches it is not anonymous: it carries the visitor’s IP address, user-agent and the referring URL to an offshore edge. An IP address and the headers that travel with it are personal information, and disclosing them to infrastructure outside the mainland is the kind of cross-border transfer the Personal Information Protection Law governs (Articles 38–40 — notice, a separate consent, and one transfer mechanism). In practice this is modest next to the personal data your own forms, logins and logs handle, and it is easy to overlook — but on a site that is otherwise careful about where its users’ data goes, an offshore subresource quietly adds one more outbound path. Whether it rises to anything you must act on is a risk to settle with counsel against what you actually collect.
Where the ICP line actually falls — on the site that embeds jQuery
Getting the compliance door right means being precise about where it stands. The library CDN needs no ICP filing — the public site that embeds it does. A website shown to mainland visitors turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, bound to a hosting resource physically inside the mainland — something an offshore library host structurally cannot be. And where that embedding site collects personal information from Chinese users, the cross-border-transfer and data-localization rules reach its own data flows: for a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) — the data-localization provision was renumbered by the 2025 amendment that took effect on January 1, 2026, with its substance unchanged). The jQuery file sits inside none of that, but there is an overlap worth noticing: the very move that fixes the reachability problem — serving the library from inside China — is the same move that puts your delivery onto an in-country, ICP-filed footing. Removing the offshore dependency and standing on lawful in-country ground turn out to be one step.
This is a reachability-and-risk map, not a verdict: whether a stalled library merely degrades your mainland site or actually breaks it, and whether your own hosting and data position holds up, depends on how your front-end is assembled and what you collect — worth settling with counsel and an honest look at your real dependencies.
The lawful path — map, localize, deliver
There is a reliable, lawful way to keep jQuery in a China-facing site, and it has a shape. First, map: our China team works out whether the offshore jQuery dependency merely slows your mainland pages or can take them down, and charts the footing underneath — the ICP filing the embedding site needs, and the PIPL exposure of the data that site itself collects. The legal conclusions are settled with counsel; we build the technical picture that feeds them.
Then localize: we take the offshore library off the critical path. The same jQuery your pages already reference is served from inside the mainland — self-hosted from your own origin, or delivered from a China-reachable, ICP-filed source — so the file no longer depends on an edge across the border to show up. Your <script> tags keep naming the library you chose; what changes is that the bytes arrive from the right side of the border.
Then deliver: the in-country delivery is ICP-filed and set in front of the origin you already run — the 21YunBox Optimizer — with no rebuild and no second codebase. The result is a China-facing front-end whose dependencies load, every time, and a site that runs legally and compliantly for your users in China. What we never do — and what no one lawfully can — is tunnel a blocked resource through a network workaround: we relocate what must be served in-country and deliver it on lawful footing, nothing more.
Related reading:
- How to get an ICP filing for China
- Cross-border data transfers under PIPL
- China’s Cybersecurity Law (data localization, Article 39)
