Does LogRocket Work in China? Session Replay, PIPL & Data Residency
LogRocket records your users' sessions — DOM, inputs, network, console and IP — and hosts that data in the United States, with no mainland-China region. Recording a mainland visitor ships their personal information offshore under PIPL. A compliance-first look at the data-residency door.
Does LogRocket work in China?
The script will load — that is the easy part. The hard part is that LogRocket records your users' sessions and, in its own words, hosts that data in the United States, so recording a mainland visitor ships their personal information offshore. That is a PIPL question, not a performance one.
LogRocket's SDK reconstructs the session — the DOM, clicks, inputs, network and console — and by default "captures IP addresses to enable reverse-IP lookups for location search"; for SaaS customers its own FAQ says "data is hosted in the United States," with no mainland-China region. Recording a China-based user therefore moves their personal information out of the mainland — a cross-border transfer of personal information PIPL governs (notice, separate consent and a transfer mechanism) — and a session replay is about as personal as that data gets. LogRocket does offer sanitization controls and never records password fields, but those shrink the payload; they do not change where it lands. The table below is LogRocket's own wording and the rule each line triggers.
This is a risk map, not a verdict — how much exposure you carry turns on what you record, how you sanitize and who your users are. Our China team can map your exposure with you →
Compliance snapshot
- ! Session replay captures the DOM, inputs, network and console — heavy personal data
- ✕ LogRocket hosts SaaS session data in the United States — no mainland-China region
- ! Recording mainland users' sessions is a cross-border transfer under PIPL
- ! IP capture is on by default — reverse-IP location on every session
- ✓ Sanitization controls exist and password fields aren't recorded — but you must switch them on
What LogRocket's own documentation says about China
| Fact | Primary source |
|---|---|
LogRocket records the whole session, not a metric. In its own privacy docs the SDK "can automatically sanitize all text, inputs, and images from your session recordings" — a control you switch on, because a replay otherwise reconstructs what the user saw and typed, along with network requests and the console. "Password fields are never recorded," and you can mark an element with a data-private attribute to "prevent recording its input," but everything you do not sanitize is captured. Under China's law that recording is personal information. | LogRocket — Recording and privacy (docs.logrocket.com/docs/privacy), retrieved 2026-10-07 |
IP capture is on by default — and an IP is location-grade personal data. LogRocket's docs state it "captures IP addresses to enable reverse-IP lookups for location search, and to help you match between back-end logs and captured sessions," with the shouldCaptureIP option defaulting to true. For a mainland visitor, that IP and the location derived from it are personal information leaving the mainland the instant they reach LogRocket — a cross-border transfer under PIPL (Articles 38–43). | LogRocket — Enable or Disable IP Capture (docs.logrocket.com/reference/shouldcaptureip), retrieved 2026-10-07; PIPL Articles 38–43 |
| That data is hosted in the United States, and there is no mainland-China region. LogRocket's FAQ states that "for SaaS customers, data is hosted in the United States," and it publishes no mainland-China data location (inference from its absence in the docs). A session recorded for a China-based user is therefore stored offshore — the cross-border transfer PIPL governs — and for a critical information infrastructure operator or large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)), a residency duty US hosting cannot meet. | LogRocket — Frequently Asked Questions (docs.logrocket.com/docs/q-a), retrieved 2026-10-07; PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
| The PIPL duty is yours, and it attaches before you press record. Because LogRocket stores the data offshore, you — the handler who embeds the SDK, not LogRocket — carry the obligations for your mainland users: notice, separate consent for the cross-border transfer, and one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification) under PIPL Articles 38–43. A reverse-IP "location search" on a Chinese user is precisely the processing that consent has to cover. | LogRocket docs — IP capture & FAQ (docs.logrocket.com), retrieved 2026-10-07; PIPL Articles 38–43 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the deciding question about LogRocket is not whether its script loads — it is whether you are allowed to record what it records. LogRocket is session replay: it reconstructs your users’ sessions from the DOM, their clicks and inputs, the network traffic and the console, and by default it captures their IP address as well. In its own documentation that data, for SaaS customers, “is hosted in the United States,” and no mainland-China region is on offer. So the moment LogRocket records a visitor in Shanghai or Shenzhen, their personal information leaves the mainland — and that is a question China’s privacy law settles long before latency ever enters it.
LogRocket in China at a glance
| What decides it | In LogRocket's own terms |
|---|---|
| Where your data lives | For SaaS customers, LogRocket says “data is hosted in the United States.” It publishes no mainland-China region, so sessions recorded for Chinese users are stored offshore. |
| What it records | Session replay — the DOM, clicks, inputs, network requests and console. The SDK “can automatically sanitize all text, inputs, and images,” and “password fields are never recorded,” but sanitizing is something you switch on. |
| IP and location | On by default: LogRocket “captures IP addresses to enable reverse-IP lookups for location search.” For a mainland visitor that is location-grade personal information. |
| The cross-border trigger | Recording a China-based user moves their personal information out of the mainland — a cross-border transfer PIPL governs, calling for notice, separate consent and a transfer mechanism. |
| Who carries the duty | You, the handler embedding the SDK — not LogRocket. For a CIIO or large-volume handler, personal information collected in China must be stored in the mainland. |
Session replay is personal data — the heaviest kind
LogRocket does not sample a few metrics; it records the session. Its own privacy documentation describes an SDK that reconstructs what the user saw and did — the DOM and its mutations, clicks and keystrokes, network requests and the console — and then offers you controls to hold some of it back. The SDK “can automatically sanitize all text, inputs, and images from your session recordings,” “password fields are never recorded,” and you can tag an element with a data-private attribute to “prevent recording its input.” Those controls matter, and you should use them. But they are opt-in, and everything you do not sanitize is captured as the user types it. A recording that detailed is personal information under China’s Personal Information Protection Law — not metadata, and for some fields potentially sensitive personal information, which the law guards more tightly still.
Your China users’ sessions are stored in the United States
Where that recording lands is what turns a privacy feature into a compliance exposure. LogRocket’s FAQ states plainly that “for SaaS customers, data is hosted in the United States,” and it publishes no mainland-China region. So a session captured from a user in the mainland is written to servers outside it. Under the Personal Information Protection Law that is a cross-border transfer, and the handler — you, the site embedding LogRocket, not LogRocket itself — has to give notice, obtain separate consent for the transfer, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification (PIPL Articles 38–43). The IP capture compounds it: LogRocket “captures IP addresses to enable reverse-IP lookups for location search” by default, so location-grade data about a Chinese user is in the payload from the first session. And if you are a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty United States hosting cannot satisfy.
Reachable is the easy half — being allowed to record is the hard one
LogRocket’s ingest is an embedded script, and whether it loads cleanly from the mainland is a delivery question — the kind that varies by network and is the smaller half of “does it work.” The larger half is legal, and it does not improve with tuning: a session you record quickly but had no lawful basis to take is still a problem. LogRocket is not a public website you file for an ICP yourself — it is a backend recorder sitting inside a site you operate — so what it adds to your China footprint is not an ICP question but a cross-border data flow, created the instant it records a mainland user. Reachability decides whether the recording arrives; PIPL decides whether you were allowed to make it.
This is a risk map, not a verdict: how much exposure you carry turns on what you record, how thoroughly you sanitize, your role and data volumes, and who your users are — worth settling with counsel before you record at scale.
Where 21YunBox fits — a compliant overlay, not a migration
You keep LogRocket exactly where it is. What we add is the compliance layer around it. Our China team maps what your recordings actually capture from mainland users — sessions, inputs, IP-derived location — and assesses the PIPL cross-border and data-residency exposure that creates for your entity and your data volumes; then we stand up the ICP-filed, in-country delivery a lawful China presence needs, set in front of your existing origin, with no rebuild, no second codebase and no move off the tools you run today. LogRocket stays your session-replay tool; the cross-border and residency gaps become ours to map and close with you.
Related reading:
Frequently Asked Questions
Is LogRocket blocked in mainland China?
Treat reachability as the smaller question. LogRocket's ingest is an embedded script, and it may load slowly or intermittently from the mainland — but whether it "works" is decided by compliance, not the network. The moment it records a China-based user, their session and IP are sent to LogRocket's US-hosted service, which is a cross-border transfer of personal information under PIPL. A recording you made quickly but had no lawful basis to take is still a problem.
Does turning on LogRocket's sanitization make it compliant?
It helps, but it does not settle the question. LogRocket's SDK "can automatically sanitize all text, inputs, and images," never records password fields, and lets you mark elements data-private — all worth doing. But IP capture is on by default, the replay still reconstructs behavior, and the data is still hosted in the United States. Sanitization shrinks the payload; it does not change the fact that personal information of your mainland users leaves the mainland, which is the PIPL trigger. Whether your configuration is enough is a judgment to make with counsel.
Can 21YunBox help us keep using LogRocket in China?
Yes. Our China team can map what your LogRocket setup actually captures from mainland users — sessions, inputs, IP-based location — and assess the PIPL cross-border and data-residency exposure that creates for your entity and data volumes, then line up the consent, transfer mechanism and ICP-filed, in-country delivery a compliant China presence needs, without ripping LogRocket out of your stack. Get in touch to work through your specific case.
