Does Pardot Work in China? Data Residency, PIPL & an Offshore Cloud
Pardot — now Marketing Cloud Account Engagement — runs only on Salesforce's US cloud with no mainland-China region, so the prospect and behavioral data you collect from China visitors lands offshore under PIPL, and the tracking code and forms you embed fall under your site's ICP filing. A compliance-first look at the doors.
Does Pardot work in China?
Reachable, yes — but compliant is a different question. Pardot (which Salesforce now calls Marketing Cloud Account Engagement) runs only on a US cloud with no mainland-China region, so every prospect you collect in China is stored offshore, and the tracking code and forms you embed ride a site that still needs an ICP filing.
Salesforce's own Infrastructure and Sub-processors documentation names the host for Marketing Cloud Account Engagement's “all functionality” as “Amazon Web Services, Inc.” in the “United States,” and its security documentation places Customer Data under the “EU-US Data Privacy Framework” — no Chinese region appears anywhere. Collecting names, emails and tracked behavior from visitors in China and storing them there is a cross-border transfer of personal information PIPL governs (Articles 38–43), while the Pardot tracking code and forms on your public pages sit under that site's ICP filing. The table below is Salesforce's own wording and the rule each part triggers.
This is a risk map, not a verdict — which duties bind turns on your entity, your data volumes and who your visitors are. Our China team can map your exposure with you →
Compliance snapshot
- ! Your China prospects' data lands on Salesforce's US cloud — offshore
- ! That offshore storage is a PIPL cross-border transfer of personal data
- ✕ Pardot has no mainland-China region, so no in-country data residency
- ! The Pardot tracker and forms you embed fall under your site's ICP filing
- ! Those assets load from offshore — reaching mainland visitors is a delivery risk
What Pardot's own documentation says about China
| Fact | Primary source |
|---|---|
| Pardot runs on Salesforce's US cloud — it has no mainland-China region. In Salesforce's own Infrastructure and Sub-processors documentation, the hosting provider for Marketing Cloud Account Engagement's “all functionality” is “Amazon Web Services, Inc.” in the “United States,” and no mainland-China location appears anywhere in the document. Collecting prospects in China and storing them there is a cross-border transfer of personal information under PIPL (notice, separate consent and a transfer mechanism, Articles 38–43); for a CIIO or large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — which a US-only service cannot do. | Salesforce — Infrastructure and Sub-processors (salesforce.com), retrieved 2026-10-07; PIPL Articles 38–43 & 40; Cybersecurity Law Article 39 (formerly Article 37) |
| Salesforce itself files your Pardot data under US and EU frameworks, not a Chinese one. Its Marketing Cloud Account Engagement Security, Privacy and Architecture documentation states Customer Data is “within the scope of annual certifications to the EU-US Data Privacy Framework … as administered by the US Department of Commerce,” and that all Customer Data “is automatically replicated on a near real-time basis” and backed up to “an off-site backup location.” None of those locations is in mainland China, so a China-facing deployment leaves your prospect data offshore under PIPL's cross-border rules. | Salesforce — Marketing Cloud Account Engagement Security, Privacy and Architecture (published May 22, 2026), retrieved 2026-10-07; PIPL Articles 38–43 |
| The Pardot tracking code and forms you embed live on your public pages — so they sit under your site's ICP filing. Salesforce help states Account Engagement “tracks visitor and prospect activities on your website and landing pages by setting cookies on their browsers,” and that a session cookie is set “when a visitor accesses a form, landing page, or page with Account Engagement tracking code.” A public site served to mainland visitors needs an ICP filing (State Council Order No. 292; MIIT Order No. 33); the embedded, offshore-loaded tracker and forms are part of what that filed site has to account for — and whether they load for mainland visitors is the delivery half, not the legal half. | Salesforce — Cookies and Activity Tracking help (help.salesforce.com), retrieved 2026-10-07; State Council Order No. 292; MIIT Order No. 33 |
| “Marketing Cloud Account Engagement” is just the new name for Pardot — the same prospect database. Salesforce calls Pardot “the legacy product name for Marketing Cloud Account Engagement” and states “They are the same product.” Whatever the label, it holds the names, emails, company and tracked behavior of the people you market to — personal information that, for visitors in China, falls squarely under PIPL, wherever Salesforce stores it. | Salesforce — B2B marketing automation product page (salesforce.com/marketing/b2b-automation), retrieved 2026-10-07 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the real question about Pardot is not whether it loads — it is whether the prospect data it gathers is allowed to live where Salesforce keeps it, and whether the pieces you bolt onto your public site are covered by the right filing. Salesforce answers the first part in its own documentation: Pardot — which it has renamed Marketing Cloud Account Engagement, though it remains the same product — runs on a US cloud with no region inside mainland China. So a China-facing Pardot deployment is reachable, but every name, email and tracked click it collects from a visitor in China is stored offshore, and the tracking code and forms you embed ride on a public site that itself needs an ICP filing. The loading is the easy part; the cross-border data and the licensing are the exposure.
Pardot in China at a glance
| What decides it | In Pardot's own terms |
|---|---|
| Where it runs | Salesforce's US cloud. The Infrastructure and Sub-processors documentation names “Amazon Web Services, Inc.” in the “United States” as the host for all functionality. No region is inside mainland China. |
| Your prospects' data | Names, emails, company and tracked behavior, stored offshore. Salesforce places Customer Data under the “EU-US Data Privacy Framework,” not a Chinese one — a cross-border transfer under PIPL for visitors in China. |
| Data residency | No in-country option. With no mainland region, Pardot cannot keep China-collected personal information in the mainland, as PIPL Article 40 and Cybersecurity Law Article 39 (formerly Article 37) require of CIIOs and large-volume handlers. |
| The embedded layer | The tracking code, forms and landing pages load on your public pages. Salesforce: it “tracks visitor and prospect activities on your website and landing pages.” Your site's ICP filing has to account for them. |
| Is it reachable? | The tracker and forms load from offshore, so reaching mainland visitors reliably is a delivery question — one that sits after, and separate from, the licensing and data-residency ones. |
No mainland region, so your prospects’ data lives offshore
Pardot’s answer to “where does my data sit” is settled before performance is ever in the room. In Salesforce’s own Infrastructure and Sub-processors documentation, the hosting provider for Marketing Cloud Account Engagement’s “all functionality” is “Amazon Web Services, Inc.” in the “United States,” and across all ninety-odd pages no mainland-China location is listed for the service. Its Security, Privacy and Architecture documentation lines up with that: Customer Data is “within the scope of annual certifications to the EU-US Data Privacy Framework … as administered by the US Department of Commerce,” is “automatically replicated on a near real-time basis,” and is backed up to “an off-site backup location” — all of it outside the mainland.
That geography is what turns Pardot into a data question. Serve your funnel to visitors in China and the personal information Pardot collects — their names, work emails, company, and the pages, forms and emails they engage with — comes to rest on US infrastructure. Under China’s Personal Information Protection Law that is a cross-border transfer, and the handler (you, not Salesforce) must give notice, obtain separate consent, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification (Articles 38–43). If you are a critical information infrastructure operator or you cross the volume thresholds, personal information collected in China has to be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty a US-only service has no way to meet. “We already run Pardot” does not change any of that; it simply describes where the exposure sits.
The tracker and forms you embed ride your site’s ICP filing
Pardot is not only a database you log into — it is a set of assets you place on your own site. Salesforce describes the mechanics plainly: Account Engagement “tracks visitor and prospect activities on your website and landing pages by setting cookies on their browsers,” and a session is recorded “when a visitor accesses a form, landing page, or page with Account Engagement tracking code.” In other words, the tracking snippet, the forms and the landing pages become part of what your public site serves to the people who visit it.
For a mainland audience, that pulls the second door — licensing — into view. A public-facing website delivered to visitors inside China turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, and that filing attaches to the site operator and its mainland hosting resource. The embedded Pardot assets do not get their own filing; they ride on the filing of the site that hosts them, which means your ICP scope has to account for an offshore-loaded tracker and offshore-hosted forms. Whether those assets actually reach a mainland visitor — and render the form they are meant to fill — is a separate, delivery-side question, and an honest one: assets loaded from a US cloud are reachable but not guaranteed to behave consistently behind the border. That half is about delivery; it never substitutes for the licensing and data questions that decide whether you may use Pardot this way at all.
This is a risk map, not a verdict: whether PIPL’s cross-border duties, an in-country storage obligation, or your site’s ICP scope is the binding constraint depends on what you collect, how much of it, and who your visitors are — worth settling with counsel before you wire Pardot into a China-facing funnel.
Where 21YunBox fits — a compliant overlay, not a migration
You keep running Pardot exactly as you do today. What we add is the piece a US-only marketing cloud cannot: compliant, ICP-filed delivery from inside the mainland, set in front of the public site that embeds your Pardot tracker, forms and landing pages — no rebuild, no second codebase, and no migration off Salesforce. Our China team maps your PIPL cross-border and data-residency position for the prospect and behavioral data Pardot holds, works through how those embedded assets sit against your ICP filing, and stands up the in-country delivery a lawful China presence needs — while your Salesforce stack stays precisely where it already runs.
Related reading:
Frequently Asked Questions
Does using Pardot for China prospects break PIPL?
Treat it as a cross-border risk to assess with counsel, not a yes/no. Pardot stores prospect and behavioral data on Salesforce's US cloud, so personal information you collect from people in China leaves the mainland — which PIPL governs as a cross-border transfer requiring notice, separate consent and a transfer mechanism (Articles 38–43). If you are a critical information infrastructure operator or a large-volume handler, that data may also have to be stored in China (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). Whether and how those duties bite depends on your role, your data and your volumes.
Does Pardot itself need an ICP filing in China?
Pardot isn't a website you file — it's a layer you embed. The tracking code, forms and landing pages load on (or alongside) your public site, and it's the public site served to mainland visitors that needs an ICP filing under State Council Order No. 292 and MIIT Order No. 33. The practical questions are whether that filing accounts for the embedded, offshore-loaded Pardot assets, and whether those assets reach mainland visitors reliably — a delivery matter, separate from the filing itself.
Can 21YunBox help us run Pardot compliantly in China?
Yes. Our China team can map your exposure — your PIPL cross-border and data-residency position for the prospect and behavioral data Pardot collects, and how the embedded tracker and forms sit against your site's ICP filing — and stand up compliant, ICP-filed, in-country delivery in front of the public site that embeds Pardot, with no change to your Salesforce setup. Get in touch to work through your specific case.
