Does Moodle Work in China? ICP, Student Data & Where You Host It
Moodle is open-source software you host yourself, and MoodleCloud runs only in Ireland, Sydney or Oregon — so a China-facing Moodle is served offshore, with no ICP-filing path and your students' records crossing the border under PIPL. A compliance-first look at the two doors.
Does Moodle work in China?
Moodle runs fine in China — but "does it work" is the wrong question. Moodle is open-source software you host yourself, so whether your deployment is compliant turns on where you put the server and what happens to your students' records, not on Moodle itself.
Moodle's own documentation describes a Moodle server as anything "from a Desktop PC… to cloud VMs or other hosted solutions," and tells anyone who wants to "avoid installing Moodle yourself completely" to "consider MoodleCloud, the hosting from Moodle" — whose sites are "hosted on Amazon Web Services (AWS) infrastructure" in Ireland, Sydney or Oregon, where "hosting regions are permanent once a site has been created." Every one of those options is offshore. Serve China from there and your learners' names, grades and submissions leave the mainland — a cross-border transfer PIPL governs — on a host that cannot be ICP-filed. The table below is Moodle's own wording and the rule each hosting choice triggers.
This is a risk map, not a verdict — which obligations bite depends on your entity, your learner data and who your students are. Our China team can map your exposure with you →
Compliance snapshot
- ! Moodle is self-hosted — where it runs is your call, and most setups land offshore
- ! Students' names, grades and submissions are personal data under PIPL
- ✕ Hosted outside the mainland, a public Moodle site can't be ICP-filed
- ! MoodleCloud runs only in Ireland, Sydney or Oregon — none in mainland China
- ✓ Self-hosted and open-source, so it can sit behind ICP-filed, in-country delivery
What Moodle's own documentation says about China
| Fact | Primary source |
|---|---|
| Moodle is software you install, not a service someone runs for you — so where it lives is your decision. Moodle's own install documentation describes a "Moodle server" as anything "from a Desktop PC… to a rack-mounted or clustered solution to cloud VMs or other hosted solutions," and tells anyone who wants to "avoid installing Moodle yourself completely" to "consider MoodleCloud, the hosting from Moodle." So "does Moodle work in China" is really a question about the server you pick — and nothing in Moodle places that server inside the mainland. | Moodle — Installing Moodle (docs.moodle.org), retrieved 2026-10-07 |
| MoodleCloud, the hosted option, runs only outside mainland China. Moodle's hosting documentation states MoodleCloud "sites are hosted on Amazon Web Services (AWS) infrastructure" in one of three locations — "European Union (Ireland)," "Australia (Sydney)" and "United States (Oregon)" — and that "hosting regions are permanent once a site has been created." None is in the mainland, so a MoodleCloud site serving Chinese learners is served from offshore, with no lever to relocate it. | Moodle Services knowledge base — MoodleCloud data hosting locations (support.moodle.com), retrieved 2026-10-07 |
| A public LMS for mainland visitors needs an ICP filing — and an offshore host has nothing to file against. A site served to the mainland public from inside China turns on an ICP filing (ICP 备案) bound to a licensed hosting resource physically in the mainland, under State Council Order No. 292 and MIIT Order No. 33. A self-hosted Moodle abroad — or a MoodleCloud site in Ireland, Sydney or Oregon — gives you no mainland footing to attach that filing to. | State Council Order No. 292; MIIT Order No. 33; grounded in Moodle & MoodleCloud hosting docs, retrieved 2026-10-07 |
| Your students' records are personal data, and hosting them offshore is a cross-border transfer. An LMS holds names, email addresses, grades, assignment submissions and activity logs — often for minors — all personal information under China's PIPL. Run Moodle (self-hosted or on MoodleCloud) from outside the mainland and that data leaves China: a cross-border transfer needing notice, separate consent and a transfer mechanism (PIPL Articles 38–43), with in-country storage required of large-volume handlers and CIIOs (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). | PIPL Articles 38–43 & 40; Cybersecurity Law Article 39 (formerly Article 37); grounded in Moodle/MoodleCloud offshore hosting docs, retrieved 2026-10-07 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the deciding question about Moodle is not how fast it runs — Moodle is open-source software you install on a server of your choosing, so it runs wherever you put it. The real question is where that server is allowed to sit, and what happens to the student data you keep on it. Moodle itself is freely downloadable and reachable; the exposure is the ICP filing a public mainland site requires, and the personal information — names, grades, assignment submissions, often for minors — that China’s law protects. Reaching China is the easy half. Being cleared to operate there, and holding your learners’ data where the law allows, is the half that decides it.
Moodle in China at a glance
| What decides it | In Moodle's own terms |
|---|---|
| Where it runs | You decide. Moodle is software you install yourself — a Moodle server can be anything “from a Desktop PC… to a rack-mounted or clustered solution to cloud VMs or other hosted solutions.” Nothing in Moodle places that server inside mainland China. |
| The hosted option | MoodleCloud “sites are hosted on Amazon Web Services (AWS) infrastructure” in Ireland, Sydney or Oregon, and “hosting regions are permanent once a site has been created.” No mainland region exists. |
| Serving the public | A public LMS for mainland visitors needs an ICP filing tied to a licensed mainland hosting resource. An offshore box — or a MoodleCloud site — gives you nothing to file against. |
| Your students' data | Names, grades, submissions and activity logs — often for minors — are personal information under PIPL. Held offshore, that is a cross-border transfer, with an in-country storage duty for large-volume handlers and CIIOs. |
| Is it reachable? | Moodle the software isn't blocked — it's open-source and downloadable anywhere. Whether your instance loads well depends on where you host it, but reachability is the delivery half, not the legal half. |
Moodle doesn’t run anywhere on its own — you pick the server
Moodle is not a service someone operates for you; it is open-source software you download and install. Moodle’s own documentation describes a Moodle server as anything “from a Desktop PC… to a rack-mounted or clustered solution to cloud VMs or other hosted solutions,” and for anyone who wants to “avoid installing Moodle yourself completely,” it points to “MoodleCloud, the hosting from Moodle.” Either way the software will run perfectly well — the question China forces is not whether Moodle works, but where the server you chose is allowed to sit, and what becomes of the student data on it.
The hosted path runs offshore, and the region is fixed
Take MoodleCloud and Moodle’s own hosting page is explicit: MoodleCloud “sites are hosted on Amazon Web Services (AWS) infrastructure,” in one of three locations — “European Union (Ireland),” “Australia (Sydney)” or “United States (Oregon).” There is no mainland-China location, and “hosting regions are permanent once a site has been created.” So a MoodleCloud site that serves Chinese learners is served from outside the mainland, by design and with no lever to change it. A self-hosted instance on an offshore cloud lands in exactly the same place — reachable, but not inside China.
A public mainland LMS needs an ICP filing
Reaching mainland users from inside China turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, and that filing must attach to a hosting resource physically located in the mainland. A Moodle box in Frankfurt, or a MoodleCloud site in Ireland, has no such resource to attach to — there is simply nothing in the mainland to file against. This is the gap that “we already run Moodle” cannot close on its own: being reachable from China is not the same as being cleared to operate there, and no amount of tuning conjures the mainland footing a filing needs.
Your students’ records are personal data, and PIPL follows them
An LMS is a personal-data system first. It holds names, email addresses, grades, assignment submissions and detailed activity logs — frequently for minors, which raises the bar further. Serve China from an offshore Moodle and that information lives outside the mainland, which China’s Personal Information Protection Law treats as a cross-border transfer: as the handler you must give notice, obtain separate consent, and clear one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification (PIPL Articles 38–43). If you are a large-volume handler or a critical information infrastructure operator, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty no offshore Moodle host can meet.
This is a risk map, not a verdict: whether you need an ICP filing, in-country storage, or both depends on what your Moodle serves, how much student data you hold, and who your learners are — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep running Moodle exactly as you do — self-hosted or on MoodleCloud, same code, same plugins, same gradebook. What we add is the one piece neither option provides on its own: compliant, ICP-filed delivery from inside the mainland, placed in front of your existing Moodle origin — no rebuild, no second instance, and no move off Moodle. Our China team maps your ICP and data-residency duties against your entity, your learner numbers and the student data you hold, then stands up the in-country delivery and storage a lawful China presence requires, while your LMS stays right where it already lives.
Related reading:
Frequently Asked Questions
Does our existing Moodle or MoodleCloud site work in China?
It will load, but that is the delivery half, not the compliance half. Because Moodle is self-hosted, the real question is where your server sits: a self-hosted instance on an offshore cloud, or a MoodleCloud site — which Moodle hosts on AWS in Ireland, Sydney or Oregon — is served from outside the mainland. From there a public site cannot hold an ICP filing, and your students' personal data sits offshore as a cross-border transfer under PIPL. "We already run Moodle" does not, by itself, make the deployment compliant for mainland China.
Is it illegal to run Moodle for Chinese students from offshore?
Treat it as a risk to assess with counsel, not a flat yes or no. Two things follow from hosting offshore: your learners' personal information — names, grades, submissions, often for minors — leaves the mainland, which PIPL governs as a cross-border transfer (notice, separate consent and a transfer mechanism), and a public LMS served from outside mainland China cannot be ICP-filed. Whether a data-localization duty also applies turns on your role (for example a CIIO) and the volume of personal data you handle.
Can 21YunBox help make our Moodle work in China?
Yes. Our China team can map which obligations apply — assessing your PIPL cross-border and data-residency exposure for your entity, your learner numbers and the student data you hold — and stand up the ICP-filed, in-country delivery a compliant China presence requires, in front of the Moodle or MoodleCloud instance you already run. Get in touch to work through your specific case.
