Does Loox Work in China? Reviewer Data, PIPL & an Offshore Review Widget
Loox runs your review widget and stores the reviewer data it collects — names, emails, photos and videos — on infrastructure outside mainland China, with no mainland region. So a China-facing storefront fetches the widget from offshore, and the personal data your China shoppers submit becomes a cross-border transfer under PIPL. A compliance-first look at the two doors.
Does Loox work in China?
Whether you can use Loox in China is first a question about where your reviewers' data lives — and whether the widget reaches your shoppers — not about raw speed. Loox is a Shopify app that collects and displays customer reviews with photos and videos, so it gathers personal information from your China shoppers and serves that content back from its own infrastructure.
In its own End-User Privacy Policy, Loox describes itself as "a data Processor" that "processes such personal information on the Merchant's behalf, which is the data Controller," and says that, to run the Service, it "will transfer your information to countries outside the EU or the UK" — naming no mainland-China location. So the names, emails, photos and videos your China shoppers submit are held offshore: a cross-border transfer of personal information PIPL governs, and the duty sits with you, the merchant — not Loox. Because the widget itself is fetched from offshore, a China-facing storefront can also load it late. The table below is Loox's own wording and the rules it triggers.
This is a risk picture, not a verdict — your obligations turn on your data volumes, your role and how sensitive your review content is. Our China team can map your Loox exposure with you →
What Loox's own documentation says about China
| Fact | Primary source |
|---|---|
| In Loox's own words: Loox is "a data Processor" that "processes such personal information on the Merchant's behalf, which is the data Controller." That line settles who carries the China duty: under PIPL the personal-information handler is you, the merchant — not Loox — so the cross-border and consent obligations for your reviewers' data land on you. | Loox — Privacy Policy (End Users), retrieved 2026-10-07 |
| In Loox's own words: to run the Service it "will transfer your information to countries outside the EU or the UK." Loox names no mainland-China storage location, so the reviewer personal data it collects from your China shoppers — names, emails, and the photos and videos they submit — is processed and stored offshore. | Loox — Privacy Policy (End Users), retrieved 2026-10-07 |
| Reviewer data gathered in China and held offshore is a cross-border transfer under PIPL. The handler — you, the merchant Loox names as the Controller — must give notice, obtain separate consent, and satisfy one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. Review photos and videos that show people are personal information and can be sensitive, which tightens the consent and necessity tests rather than relaxing them. | PIPL Chapter III, Articles 38–43 |
| The exposure scales with volume, role and sensitivity — not with merely installing the app. Under the CAC's March 2024 cross-border rules, a non-CIIO moving fewer than 100,000 individuals' non-sensitive personal information in a calendar year is exempt from the security assessment, standard contract and certification; sensitive data — which identifiable review photos and videos can be — falls under far lower thresholds and is not covered by that exemption. | CAC — Regulations on Promoting and Regulating Cross-border Data Flows, March 2024 |
| For a CIIO or large-volume handler, personal information collected in China must be stored inside the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). Loox publishes no mainland-China region, so the only way to keep your China reviewers' data on Chinese soil is to run that collection and storage on infrastructure inside the mainland — the same place your public storefront's ICP-filing question is answered. | PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China storefront, the deciding question about Loox is not how slick the review gallery looks — it is where the data behind that gallery lives, and whether the gallery even reaches your shoppers. Loox is a Shopify app that collects customer reviews with photos and videos and shows them back on your product pages, so it gathers personal information from your China customers and both stores and serves that content from its own infrastructure outside the mainland. Two things follow, and Loox spells out both in its own privacy policy: the reviewer data your China shoppers submit crosses the border, and the widget that renders it is fetched from offshore. The first is a compliance exposure; the second is a delivery one.
Loox in China at a glance
| What decides it | In Loox's own terms |
|---|---|
| Where it runs | Loox runs the review widget and stores the reviews it collects on its own infrastructure outside mainland China; it publishes no mainland region. |
| What it collects | Reviewer personal information — a shopper's name and email, plus the photos, videos and text they submit as a review. |
| Loox's role | In its own words, “a data Processor” that processes the data “on the Merchant's behalf, which is the data Controller.” The PIPL handler duty is the merchant's, not Loox's. |
| Where that data goes | Loox “will transfer your information to countries outside the EU or the UK” — offshore, with no mainland-China location named: a cross-border transfer under PIPL. |
| Reaching shoppers | The widget's script and media are fetched from offshore, so on a China-facing storefront they can arrive late or render only partially. Reachability is the delivery half; where the data lives is the compliance half. |
The review widget is served from offshore
Loox renders your reviews by loading its script and media from its own hosts, which sit outside mainland China. An asset fetched across the border is a weak link on a China-facing page: it can arrive late, render only partially, or drag down the product page it sits on, because the request has to travel out of the country and back. We publish no first-party China measurement for Loox, so we put no number on it here and we do not assert how it behaves on any given visit — the structural point is simply that an offshore widget is delivery risk you carry on every China page view. That is the delivery half of the question. It is real, but it is not what decides whether you may use Loox. That turns on where the data goes.
Your reviewers’ data leaves China — and the duty is yours
The content Loox collects is personal information: a shopper’s name and email, and the photos and videos they upload with a review. In its own End-User Privacy Policy, Loox describes itself as “a data Processor” that “processes such personal information on the Merchant’s behalf, which is the data Controller,” and states that, to run the Service, it “will transfer your information to countries outside the EU or the UK.” It names no mainland-China location. So personal data gathered from your China shoppers is held offshore, and — because Loox is the processor and you are the controller — the China obligations fall on you, the merchant.
Under China’s Personal Information Protection Law, sending that data out of the country is a cross-border transfer: you must give notice, obtain separate consent, and clear one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification. Review photos and videos that show people are themselves personal information and can be sensitive, which raises the bar on consent and necessity rather than lowering it. And if you are a critical information infrastructure operator or a large-volume handler, personal information collected in China has to be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty an offshore app cannot meet.
And the storefront itself has an ICP question
Separately from Loox, the Shopify store the widget lives on is a public-facing site. Served to mainland visitors from inside China, that turns on an ICP filing (ICP 备案) tied to a hosting resource physically in the mainland — footing an offshore Shopify storefront does not have. Loox does not change that one way or the other; it is worth flagging only because a China launch usually has to answer the storefront’s licensing question and the reviewer-data question at the same time.
This is a risk map, not a verdict: whether you need separate consent, a transfer mechanism, in-country storage, an ICP filing, or some combination depends on what you collect, how much, how sensitive it is, and who your users are — worth settling with counsel before you launch in China.
Where 21YunBox fits — a compliant overlay, not a migration
You keep Loox, and you keep your Shopify store. We add the piece an offshore app cannot: compliant, ICP-filed delivery from inside the mainland, set in front of your existing storefront so the review widget and its media reach China shoppers from in-country — no rebuild, no second store, and no move off Loox or Shopify. Our China team maps your PIPL cross-border and data-residency exposure against your entity, your data volumes and how sensitive your review content is, then stands up the in-country delivery and, where the law requires it, the in-country storage a lawful China presence needs.
Related reading:
