Does Klaviyo Work in China? PIPL, Cross-Border Data & Offshore Hosting
Klaviyo holds your subscribers' names, emails, phone numbers and behavior on US infrastructure — Amazon Web Services, with no mainland-China region. For Chinese subscribers that makes everyday use a PIPL cross-border transfer needing its own separate consent, not just a speed problem. A compliance-first look at the two doors.
Does Klaviyo work in China?
Whether you can use Klaviyo in China is first a data-residency question, not a speed one. Klaviyo is a customer-data platform — it holds the email addresses, phone numbers, purchase histories and on-site behavior your marketing runs on — and where it keeps that data is what China's law responds to.
By Klaviyo's own sub-processor list, its cloud hosting provider is “Amazon Web Services, Inc.” with a data hosting location of the “United States,” and its data-processing terms offer only one other residency — the EU, on request. None is in mainland China. So marketing to your Chinese subscribers routes their personal information offshore: a cross-border transfer PIPL governs, needing notice, a separate consent for the transfer that your email or SMS opt-in does not cover, a transfer mechanism, and — for a CIIO or large-volume handler — in-country storage. The table below is Klaviyo's own wording and the rules it triggers.
This is a risk picture, not a verdict — your obligations turn on your subscriber volumes and your role. Our China team can map your Klaviyo exposure with you →
Compliance snapshot
- ! Reachable, but Klaviyo-hosted forms, tracking and campaign images are served from the US — they cross the border
- ! Stores subscriber profiles — names, emails, phone numbers, purchase & behavioral data — in the US on AWS
- ! That offshore marketing data is a PIPL cross-border transfer needing its own separate consent and a transfer mechanism
- ✕ No mainland-China hosting region or data-residency option (US default, EU only on request)
- ✓ A compliant, ICP-filed in-country delivery path exists — no rebuild, no migration
What Klaviyo's own documentation says about China
| Fact | Primary source |
|---|---|
| In Klaviyo's own words: its public sub-processor list names “Amazon Web Services, Inc.” as a “Cloud Hosting Provider,” with both its processing location and data hosting location given as the “United States.” No mainland-China location appears anywhere on the list — so the subscriber data behind your campaigns is hosted offshore. | Klaviyo — Sub-processors, retrieved 2026-10-07 |
| Klaviyo's Data Processing Addendum says it will store customer personal data “within the European Union” only “where Customer has stipulated EU data residency”; absent that election the data sits wherever Klaviyo and its sub-processors “maintain facilities” — which, per that same list, is the US. The two residency options Klaviyo documents are a US-based default and the EU on request: there is no mainland-China data-residency option. | Klaviyo — Data Processing Addendum, §4.4, retrieved 2026-10-07 |
| Holding your Chinese subscribers' names, emails and phone numbers in the US is a cross-border transfer of personal information under PIPL. The handler — you, Klaviyo's customer, not Klaviyo — must give notice, obtain separate consent for the transfer, and satisfy one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. That separate consent is distinct from your email or SMS marketing opt-in. | PIPL Chapter III, Articles 38–39 |
| How heavy the obligation is scales with volume and role, not merely with using the tool. Under the CAC's March 2024 cross-border rules, a non-CIIO transferring fewer than 100,000 individuals' non-sensitive personal information in a calendar year is exempt from the security assessment, standard contract and certification — a threshold a growing marketing list can cross without anyone noticing. | CAC — Regulations on Promoting and Regulating Cross-border Data Flows, March 2024 |
| For a CIIO or large-volume handler, personal information collected in China must be stored inside the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). Because Klaviyo publishes no mainland-China region, the only way to keep your China subscribers' marketing data on Chinese soil is to run that storage on infrastructure inside the mainland — which is where an ICP filing enters the picture. | PIPL Article 40; CSL Article 39 (formerly Article 37) |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the deciding question about Klaviyo is not how fast its sign-up forms paint — it is where the subscriber data behind them is allowed to live. Klaviyo is a customer-data platform: it holds the names, email addresses, phone numbers, purchase histories and on-site behavior your campaigns and flows run on, and it keeps that data on infrastructure in the United States. For your Chinese subscribers, everyday use of Klaviyo therefore moves their personal information across the border — and China’s law has something to say about that long before performance does. Klaviyo answers the where-does-it-live question in its own sub-processor list and data-processing terms.
Klaviyo in China at a glance
| What decides it | In Klaviyo's own terms |
|---|---|
| Where it runs | Klaviyo's cloud hosting provider is “Amazon Web Services, Inc.,” with its processing and data hosting location given as the “United States.” Beyond that US default, the only residency it documents is the EU, on request — no region is inside mainland China. |
| What it holds | Subscriber profiles — names, email addresses, phone numbers, purchase and behavioral events — the personal information your segments, flows and campaigns target. |
| What it serves | Sign-up and pop-up forms, the on-site tracking snippet, and campaign images are delivered from that same US infrastructure; for a mainland visitor each request crosses the border. |
| Your China subscribers' data | Held in the US — a cross-border transfer PIPL governs, needing a separate consent distinct from your marketing opt-in, plus one transfer mechanism (CAC assessment, standard contract, or certification). |
| Data residency | With no mainland Klaviyo region, a CIIO or large-volume handler cannot meet an in-country storage duty on Klaviyo alone. |
Your subscribers’ data lives in the United States, not China
Klaviyo’s cloud hosting provider is Amazon Web Services, and on its own sub-processor list the processing and data hosting location for that provider is the United States. Its Data Processing Addendum adds the only other option: Klaviyo will store customer personal data “within the European Union” only “where Customer has stipulated EU data residency.” Outside that election, your data sits wherever Klaviyo and its sub-processors “maintain facilities” — which, per that same list, is the US. Not one of the residency choices Klaviyo documents is inside mainland China.
That geography settles the data question before performance enters it. The names, email addresses and phone numbers you collect from Chinese subscribers are personal information under China’s Personal Information Protection Law, and holding them in the US is a cross-border transfer the law governs. The handler — you, not Klaviyo — has to give notice, obtain separate consent, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. “We already run on Klaviyo” does not carry into China; it only means the transfer is already happening.
Marketing opt-in is not the separate consent PIPL asks for
Marketing teams often assume a subscriber who opted in to email or SMS has consented to everything that follows. PIPL draws a line that opt-in does not cross: sending personal information outside China is treated as its own act, and it requires a separate consent, distinct from the consent to market to that person. Collecting a valid email opt-in and then syncing that contact into a US-hosted platform are two different permissions under the law.
How heavy the rest of the obligation is depends on scale and role, not merely on using the tool. Under the CAC’s March 2024 cross-border rules, a non-CIIO moving fewer than 100,000 individuals’ non-sensitive personal information in a year is exempt from the security assessment, standard contract and certification — but a marketing list is exactly the kind of asset that grows past that line quietly. A critical information infrastructure operator or large-volume handler also faces an in-country storage duty (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) that an offshore platform cannot satisfy.
Forms, tracking and pages are served from offshore too
Klaviyo does more than store data — it serves things to your visitors. Sign-up and pop-up forms, the on-site tracking snippet that records browsing and builds profiles, and the images inside a campaign are all delivered from Klaviyo’s US infrastructure. For a visitor in Shanghai or Shenzhen, each of those requests leaves the mainland and comes back. We have published no first-party measurement of Klaviyo from inside China, so we put no load-time number on it here; the point is architectural, not a benchmark.
Two consequences matter for compliance. First, a form that captures an email or phone number ships that personal information straight into an offshore system — the cross-border transfer begins at the moment of capture, not later. Second, a public-facing sign-up page or landing page served to mainland visitors from inside China is itself subject to the ICP filing regime under State Council Order No. 292 and MIIT Order No. 33, for which Klaviyo’s US hosting gives you no footing. Reaching Klaviyo is not the same as being cleared to collect and move Chinese users’ data through it.
This is a risk map, not a verdict: whether you need separate consent alone, a formal transfer mechanism, in-country storage, or some combination depends on what you collect, how much of it, and who your subscribers are — worth settling with counsel before your next send.
Where 21YunBox fits — a compliant overlay, not a migration
You keep running Klaviyo. We add the piece a US-hosted marketing platform cannot: compliant, ICP-filed delivery from inside the mainland, placed in front of the Klaviyo-hosted forms, tracking and pages your Chinese visitors actually touch — no rebuild, no second marketing stack, and no move off Klaviyo. Our China team maps your PIPL cross-border and data-residency exposure against your subscriber volumes and your role, helps put the separate-consent and transfer-mechanism path in place, and — where the law requires your China subscribers’ data to stay on Chinese soil — stands up compliant in-country delivery and storage alongside it, while your Klaviyo account stays exactly where it already runs.
Related reading:
Frequently Asked Questions
Does Klaviyo store Chinese subscribers' data in China?
No. Klaviyo's own sub-processor list hosts customer data with Amazon Web Services in the United States, and the only alternative residency it documents is the EU, on request. There is no mainland-China region, so the profiles, phone numbers and behavior of your China subscribers are held offshore.
We already have marketing opt-in — isn't that enough under PIPL?
Not on its own. PIPL treats sending personal information outside China as a separate act that needs its own separate consent, distinct from the consent you collected to email or text someone. You also need a lawful transfer mechanism, and possibly in-country storage if your volumes or role trigger it. Treat it as a risk to confirm with counsel, not a settled yes.
Can 21YunBox help make our Klaviyo setup compliant in China?
Yes. Our China team can assess your cross-border and data-residency exposure for your subscriber volumes and role, help put the separate-consent and transfer-mechanism path in place, and — where the law requires your China subscribers' data to stay on the mainland — stand up compliant, ICP-filed in-country delivery and storage in front of Klaviyo. Get in touch to work through your case.
