Does MaxMind Work in China? Data Residency, ICP & Cross-Border Rules

For a product that reaches users in mainland China, the question is rarely whether MaxMind can return a location for an IP address. It can. MaxMind is an IP geolocation service: you hand it an IP address and it resolves it to a country, region, city and often a precise set of coordinates. That is exactly why “does MaxMind work in China?” is the wrong place to stop. What decides whether you can run it in China is not whether the lookup succeeds — it is whether the IP address you are resolving may lawfully leave the country, whether a precisely resolved location is sensitive personal information you collected with the right consent, and on whose filing the China-facing surface sits. Those are compliance questions, and a reachability check answers none of them.

There is a genuinely good piece of news buried in MaxMind’s own product line, and it decides the whole verdict: MaxMind does not only sell a hosted lookup. It also ships its GeoIP data as a downloadable database you host and query on your own servers. Resolve China users’ IPs locally, in-country, from that database file, and no China user’s IP address is ever sent to MaxMind at all. The hosted web-service path is the one that crosses the border. So this is not a “blocked” story — it is a choose-the-right-path story.

MaxMind in China at a glance

What MaxMind receives — and why an IP address is the whole question

Start with what actually goes into a geolocation lookup. MaxMind’s job is to turn an IP address into a place, so the input it receives is the IP address of the person whose location you want — and, for the finer-grained products, a precise point on a map. Under China’s law that input is not neutral telemetry. An IP address can identify or single out a real person, so it is personal information, and the location it resolves to, when precise, can rise to sensitive personal information. The moment you resolve a China user’s IP with an offshore service, you have collected personal information and moved it across the border — before anything is displayed on screen.

That is why the interesting question is not whether MaxMind answers, but which MaxMind you are using. The hosted web service and the downloadable database carry the same data but live on opposite sides of the compliance line.

The downloadable database is a real residency lever — not a workaround

Here is the part that makes MaxMind different from a pure hosted API, and the part a reachability check cannot reach. MaxMind publishes its GeoIP data as a file you download and host yourself. Its own GeoIP Databases page invites you to “Access, download, and locally host GeoIP databases,” delivered in MMDB or CSV format, and to “Host our databases locally to eliminate network latency and per-query charges.” The commercial GeoIP2 line and the free GeoLite2 tier are both distributed this way; GeoLite2 is the free edition and is less precise than the paid data, a detail worth confirming against MaxMind’s current terms for your use.

The compliance consequence is large. When the database is a file running on infrastructure inside the mainland, resolving a China user’s IP is a local, in-process lookup — the IP address is never transmitted to MaxMind, and nothing crosses the border. That is a genuine data-residency path, achieved by keeping the data in-country, and it is the opposite of making an offshore endpoint merely reachable. 21YunBox never uses or suggests circumvention of any kind; the lawful answer here is simply to resolve in-country from the local database and keep the regulated data where the law says it belongs.

The hosted web-service path is the one to be deliberate about. On that path — where MaxMind’s “GeoIP web services are hosted on secure MaxMind servers” — every China-user IP you look up is sent to MaxMind, and that transfer is governed by China’s cross-border rules.

Crossing the border, consent, and sensitive location data

When you do use the hosted service, the border crossing is the regulated event. Sending China users’ IP addresses to MaxMind’s offshore servers is a cross-border transfer of personal information under PIPL Articles 38–40, which require one of the law’s transfer mechanisms — a CAC security assessment, the CAC standard contract, or certification — before the data may leave. For a critical information infrastructure operator, Cybersecurity Law Article 39 (formerly Article 37 — the 2025 Cybersecurity Law amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39, its substance unchanged) requires personal information generated in China to be stored in the mainland.

Consent sits on top of both paths. PIPL Articles 13 and 23 require a lawful basis to process personal information and specific, separate consent to share it with a third party — and resolving a user’s IP against MaxMind’s hosted service is exactly such a sharing. Where the resolved location is precise, PIPL Articles 28–29 can treat it as sensitive personal information, adding a specific-purpose, necessity and separate-consent test above ordinary data. A bundled “agree to everything” prompt does not satisfy it.

This is a risk map, not a verdict that MaxMind is “blocked” or “illegal” in China — it is neither. Which duties bite your case turns on your entity, which MaxMind product you use, how precise the location data is, your role under Chinese law, and your data volumes. Settle the specifics with counsel before your China program depends on them.

Why a “does the lookup work?” check misses all of this

MaxMind is not a service that fails to load in China. Its web service can return a result, and its databases download without trouble. That is precisely why a reachability test is the wrong instrument. “Did the lookup return a location?” tells you nothing about whether the IP you resolved is personal information that just crossed the border, whether a precise location was treated as sensitive personal information without the Article 28–29 basis, whether you had the Article 13/23 separate consent to process and share it, or whether the China-facing surface is filed. The exposure is quiet and durable: it lives in which path you chose and the consent you did or did not obtain, not in a latency number.

The lawful path — map, localize, deliver

There is a compliant way to run IP geolocation for a China audience, and it sits in front of the MaxMind setup your team already uses — no rebuild, no second stack, no migration off MaxMind.

First, map: our China team inventories exactly what your integration does — whether you call MaxMind’s hosted web service or host the downloadable database, which fields you resolve, how precise the location is, where the lookup runs, and the consent basis each flow relies on — along with the filing status of the China-facing surface. We build the technical picture; the legal conclusions are settled with counsel.

Then localize / govern: wherever China users’ IPs are involved, the compliant pattern is to resolve them in-country from MaxMind’s downloadable database, so the IP never crosses the border, and to reserve the hosted web service for non-China traffic. We help you put the Article 13/23 consent basis in front of any location processing, with the Article 28–29 treatment where a precise location is sensitive, and keep the regulated data on a lawful in-country path. Localize means keeping the data in-country; it never means a route that quietly ships personal information across the border.

Then deliver: any China-facing app or public surface you publish to mainland users is an internet information service, so it carries an ICP filing (备案) duty bound to a mainland hosting resource and needs compliant, in-country delivery. 21YunBox stands that up — the 21YunBox Optimizer — in front of what you already run. Making an offshore endpoint merely reachable is not the answer — MaxMind is already reachable in China; resolving IPs in-country from the local database, on a consented and (where needed) filed path, is. 21YunBox is a compliance overlay and partner to your MaxMind deployment, not a competitor to it.

Get a compliance assessment →

Related reading:

• China’s Personal Information Protection Law (PIPL)
• Cross-border data transfers under PIPL
• China’s Cybersecurity Law
• How to get an ICP filing for China

RELATED TECHNOLOGIES

Apple MapKit JS

Apple MapKit JS

HERE Maps

HERE Maps

IPinfo

IPinfo

OpenWeather

OpenWeather

TomTom

TomTom