Does Optimizely Work in China? Data Residency, PIPL & the ICP Door
Optimizely is reachable from mainland China, but both its experimentation platform and its CMS/DXP run offshore — logging visitor data to US or EU servers, with no mainland-China region. A compliance-first look at the PIPL cross-border and ICP exposure.
Does Optimizely work in China?
Yes — Optimizely loads from mainland China, but both halves of it run offshore, and that is where the compliance exposure sits. Its experimentation platform logs your China visitors' identifiers and behavior to US or EU servers, and a public site on its CMS/DXP has no mainland region to anchor an ICP filing — "reachable" is not the same as "cleared to operate."
Optimizely describes its CMS/DXP, Optimizely Cloud, as "a managed hosting platform built on Microsoft Azure," provisioned across six regions — Virginia, Washington, the Netherlands, Ireland, Singapore and Sydney — none inside mainland China, where "your content database and blob storage remain in your selected region." Its experimentation events each carry a "visitor ID" and behavioral metadata, stored on US or EU data servers. Serve China from either product and your users' personal information leaves the mainland — a cross-border transfer PIPL governs — while a public mainland site on an offshore platform has no footing for the ICP filing it needs. The table below pairs Optimizely's own words with the rule each one triggers.
Which obligation bites first depends on what you collect and what you publish — worth mapping before you build. Our China team can map your exposure with you →
Compliance snapshot
- ! Experimentation logs each visitor's ID and behavior — personal data under PIPL
- ! That data is stored on Optimizely's US or EU servers, off the mainland
- ✕ Optimizely Cloud runs no mainland-China region — nearest is Singapore
- ✕ A public mainland site on its offshore CMS/DXP can't be ICP-filed
- ✓ It's reachable from China — but reachability isn't what clears you to use it
What Optimizely's own documentation says about China
| Fact | Primary source |
|---|---|
| Optimizely's CMS/DXP runs on Microsoft Azure, in six regions — none in mainland China. Optimizely's own architecture documentation describes Optimizely Cloud as "a managed hosting platform built on Microsoft Azure" and provisions it across North America East (Virginia), North America West (Washington), Europe West (Netherlands), Europe North (Ireland), Asia Pacific (Singapore) and Australia East (Sydney), where "your content database and blob storage remain in your selected region." The nearest region to China, Singapore, is still offshore — there is no mainland region to serve or store from. | Optimizely — Cloud Architecture (certification.optimizely.com), retrieved 2026-10-07 |
| Optimizely's experimentation products log each visitor's identifier and behavior. In Optimizely's developer documentation, every exported experimentation row "includes the event name, visitor ID, and any metadata you sent to Optimizely Experimentation," delivered as "one row per decision or conversion event." A visitor ID tied to on-site behavior is personal information — so running experiments or personalization on mainland visitors means collecting their personal data in the first place. | Optimizely — Experimentation Events Export docs (docs.optimizely.com), retrieved 2026-10-07 |
| That visitor data lands on US or EU servers — never the mainland. Optimizely runs experimentation data from either US or EU data centers — "customers on the EU data servers can use GCS only" — and its Trust Center describes the EU option as "your data will be stored in EU data centers." Both destinations are outside mainland China, so collecting it from your China visitors is a cross-border transfer of personal information PIPL governs — requiring notice, separate consent and a transfer mechanism (Articles 38–43), and in-country storage for a CIIO or large-volume handler (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). | Optimizely — Experimentation Events Export docs (docs.optimizely.com) & EU Data Privacy, Trust Center (optimizely.com), retrieved 2026-10-07; PIPL Articles 38–43 & 40; Cybersecurity Law Article 39 (formerly Article 37) |
| A public mainland site on Optimizely's offshore CMS/DXP has nothing to ICP-file. A website served to mainland visitors from inside China needs an ICP filing bound to a hosting resource physically in the mainland (State Council Order No. 292; MIIT Order No. 33). Optimizely Cloud publishes no mainland-China region, so there is no in-country host to attach the filing to — and reaching China from Singapore or Virginia does not create the footing a filing requires, headless build or not. | Optimizely — Cloud Architecture (certification.optimizely.com), retrieved 2026-10-07; State Council Order No. 292; MIIT Order No. 33 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the first question about Optimizely is not how quickly it paints — it is whether the data it collects is allowed to leave the country, and whether a site built on it can be licensed to operate there at all. Optimizely answers the geography in its own documentation: its CMS/DXP runs on Microsoft Azure regions that stop at Singapore, and its experimentation data sits on US or EU servers. So Optimizely is reachable from China, but both of its products run entirely offshore — which turns your China visitors’ data into a cross-border transfer and leaves a public mainland site with no in-country host to file an ICP against. The reachability is real; the data residency and the licensing are the exposure.
Optimizely in China at a glance
| What decides it | In Optimizely's own terms |
|---|---|
| Where the CMS/DXP runs | Optimizely Cloud is “a managed hosting platform built on Microsoft Azure,” across six regions — Virginia, Washington, the Netherlands, Ireland, Singapore and Sydney. None is in mainland China; the nearest, Singapore, is still offshore. |
| What experimentation collects | Every exported experimentation row “includes the event name, visitor ID, and any metadata you sent to Optimizely Experimentation,” as “one row per decision or conversion event.” Visitor identifiers tied to behavior are personal data. |
| Where that data sits | On Optimizely's US or EU data servers — “customers on the EU data servers can use GCS only,” and its EU Data Hosting means “your data will be stored in EU data centers.” Both are outside the mainland. |
| Serving the public | A mainland-facing public site needs an ICP filing bound to an in-country host. Optimizely publishes no mainland region, so there is no footing to file against. |
| Is it reachable? | Yes — a page built on Optimizely loads from China. But reachability is the delivery half; the legal half is where the data lives and whether the site can be ICP-filed. |
The data door — experimentation makes your China visitors a cross-border transfer
Start with what Optimizely collects, because that exposure applies the moment a China visitor loads an experiment. In Optimizely’s developer documentation, every exported experimentation row “includes the event name, visitor ID, and any metadata you sent to Optimizely Experimentation,” delivered as “one row per decision or conversion event.” A visitor identifier tied to on-site behavior is personal information, and Optimizely stores it on US or EU infrastructure — “customers on the EU data servers can use GCS only,” and its EU Data Hosting option means “your data will be stored in EU data centers.” Either destination is outside the mainland.
Running experiments or personalization on Chinese users therefore moves their personal information across the border, which the Personal Information Protection Law governs as a cross-border transfer: the handler — you, not Optimizely — must give notice, obtain separate consent, and clear one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification) under Articles 38–43. If you are a critical information infrastructure operator or a large-volume handler, that personal information must instead be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty no US or EU region can meet.
The content door — a public Optimizely site has no mainland footing for an ICP filing
If Optimizely’s CMS/DXP serves a public website to mainland visitors, a second door opens. Optimizely describes Optimizely Cloud as “a managed hosting platform built on Microsoft Azure,” provisioned across six regions — Virginia, Washington, the Netherlands, Ireland, Singapore and Sydney — where “your content database and blob storage remain in your selected region.” Not one of those regions is inside mainland China, and the closest, Singapore, is still outside it.
That geography settles the licensing question before performance enters it. A public-facing site delivered to mainland users from inside China turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, and that filing has to attach to a hosting resource physically in the mainland. Optimizely publishes no such region, so there is nothing on the platform to file against. Reaching China from Singapore or Virginia is not the same as being cleared to publish there — and a headless front end does not change the answer, because the content it renders still comes from a region outside the mainland.
Reachable, not blocked — which is exactly the point
Optimizely is not blocked in China; a page built on it will load. But reachability is the delivery half of the question, not the legal half. Whether you may use Optimizely for a China audience turns on two facts it documents about itself — that your visitors’ personal data is stored offshore, and that there is no mainland region to anchor an ICP filing — and neither of those is a performance problem that network tuning can solve. They are compliance facts, and they hold however fast the page renders.
This is a risk map, not a verdict: whether the cross-border transfer rules, a data-localization duty, an ICP filing, or all three apply to you depends on what you collect, what you publish, and who your users are — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep building on Optimizely. We add the piece its offshore platform cannot: compliant, ICP-filed delivery from inside the mainland, placed in front of your existing Optimizely origin — no rebuild, no second codebase, and no move off the global stack your marketing and engineering teams already run. Our China team maps both doors — the PIPL cross-border and data-residency questions your experimentation and visitor data raise, and the ICP filing a public CMS/DXP site needs — then stands up the in-country delivery and storage a lawful China presence requires, while Optimizely stays exactly where it is.
Related reading:
Frequently Asked Questions
Is our Optimizely data leaving mainland China?
If you run Optimizely on your China visitors, yes. Its experimentation products log a "visitor ID" plus on-site behavior, and that data is stored on Optimizely's US or EU servers — never inside the mainland — while its CMS/DXP likewise runs on Microsoft Azure regions outside China. Collecting personal information from China users and sending it offshore is a cross-border transfer under PIPL, which expects notice, separate consent and a lawful transfer mechanism. Whether a data-localization duty also applies turns on your role (e.g. CIIO) and your data volumes — a question to settle with counsel.
Can we get an ICP filing for a site built on Optimizely?
Not on Optimizely's own infrastructure. A public website served to mainland visitors from inside China needs an ICP filing tied to a mainland hosting resource, and Optimizely Cloud publishes no mainland-China region to anchor one. The usual path is to keep your Optimizely build as the origin and place ICP-filed, in-country delivery in front of it — which is exactly the gap 21YunBox fills, with no move off Optimizely.
Can 21YunBox help make Optimizely work in China?
Yes. Our China team can map your exposure across both Optimizely products — the PIPL cross-border and data-residency questions your experimentation and visitor data raise, and the ICP filing a public CMS/DXP site needs — then stand up ICP-filed, in-country delivery in front of the Optimizely stack you already run, with no rebuild and no second codebase. Get in touch to work through your specific setup.
