Does Pendo Work in China? Product Analytics, PIPL & Data Residency
Pendo captures how your identified users behave — visitor and account IDs, events, IP and geolocation — and stores it in its own offshore cloud (GCP in the US, EU, Japan or Australia), with no mainland-China region. Recording a Chinese user is a cross-border transfer of personal information under PIPL, and the agent loads from an offshore CDN. A compliance-first look at the data-residency door.
Does Pendo work in China?
Pendo loads in mainland China — but that was never the compliance question. Pendo's whole job is to capture how your identified users behave and store it in its own offshore cloud, so recording a Chinese user ships their personal information across the border before latency ever enters the picture.
Pendo states it "uses Google Cloud Platform (GCP) as the underlying platform for storing and processing customer data," in environments in the US, EU, Japan or Australia — with no mainland-China region — and that "by default, Pendo captures IP address and geolocation information from the browser." The moment it records a visitor in Shanghai or Shenzhen, that personal information is stored offshore: a cross-border transfer PIPL governs (notice, separate consent and a transfer mechanism), and for a CIIO or large-volume handler, data collected in China must stay in the mainland. Pendo files no ICP of its own — it is a backend layer, not a public site — so that duty lands on the app you embed it in. The table below is Pendo's own wording and the rule each line triggers.
This is a risk map, not a verdict — how much exposure you carry turns on what you capture, your role and who your users are. Our China team can map your exposure with you →
What Pendo's own documentation says about China
| Fact | Primary source |
|---|---|
| Pendo stores your product-usage data in its own offshore cloud, with no mainland-China region. In Pendo's own words it "uses Google Cloud Platform (GCP) as the underlying platform for storing and processing customer data," separated into environments in "United States (US), European Union (EU), Japan, and Australia." The US environment stores data in "GCP's US Multi-Region"; the optional EU environment "ensures that no personal data is stored outside of the EU." None of the four is inside mainland China, so behavior captured from your Chinese users is stored outside it. | Pendo — Global data hosting (support.pendo.io), retrieved 2026-10-07 |
| Pendo's agent captures identified-user behavior — which is personal information. Pendo collects events keyed to a Visitor ID, and "upon the loading of a page, Pendo collects the URL, some browser information, such as language and browser version," along with clicks and focus events and any visitor and account metadata you attach. It adds that "by default, Pendo captures IP address and geolocation information from the browser." Tied to a visitor and account ID, that is personal information under PIPL, not anonymous metrics. | Pendo — Data collection and compliance (support.pendo.io), retrieved 2026-10-07 |
| Recording a mainland user is a cross-border transfer, and can trigger a residency duty. Because Pendo stores that usage data offshore, capturing it from a user in China moves their personal information out of the mainland — a cross-border transfer under PIPL that calls for notice, separate consent and one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification (Articles 38–43). For a critical information infrastructure operator or large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a duty Pendo's US, EU, Japan and Australia regions cannot meet. The handler is you, the site embedding Pendo — not Pendo. | Pendo — Global data hosting (support.pendo.io), retrieved 2026-10-07; PIPL Articles 38–43 & 40; Cybersecurity Law Article 39 (formerly Article 37) |
| The agent and its in-app guides load from an offshore CDN at runtime. Pendo installs as a snippet that "securely and asynchronously loads the Pendo Web SDK" — pendo.js — from cdn.pendo.io on every page, and Pendo says that SDK is "hosted and served on Amazon's Web Services (AWS) and Cloudfront Content Distribution Network (CDN)." From inside the mainland that offshore edge can load slowly or intermittently; and because the same agent injects your in-app guides and walkthroughs, a stalled snippet can delay or break the in-app experience it drives — the delivery half of the question, separate from the legal half. | Pendo — Data collection and compliance & Developer's guide to the install script (support.pendo.io), retrieved 2026-10-07 |
| Pendo needs no ICP filing of its own — but your app still does. Pendo is a backend analytics-and-guidance layer embedded in a site you operate, not a public website that files for a license itself, so it adds no ICP filing duty of its own (ICP 备案 under State Council Order No. 292 and MIIT Order No. 33). That duty stays with the public-facing application you embed Pendo into. What Pendo adds to your China footprint is the cross-border data flow, created the instant it records a mainland user — not an ICP question. | Pendo product documentation (support.pendo.io), retrieved 2026-10-07; State Council Order No. 292; MIIT Order No. 33 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the question about Pendo is not whether its script loads — it is whether you are allowed to collect what it collects. Pendo is a product-experience platform: one embedded agent records how your identified users move through your app — visitor and account IDs, clicks, page views, the metadata you attach — and uses that same script to push in-app guides, walkthroughs and surveys back to them. By default it captures IP address and geolocation as well. All of it lands in Pendo’s own cloud, and Pendo runs no region inside mainland China. So the moment Pendo records a user in Shanghai or Shenzhen, their personal information leaves the mainland — and that is a question China’s privacy law decides long before loading speed comes up.
Pendo in China at a glance
| What decides it | In Pendo's own terms |
|---|---|
| Where your data lives | Pendo “uses Google Cloud Platform (GCP) as the underlying platform for storing and processing customer data,” in environments in the US, EU, Japan or Australia. It publishes no mainland-China region, so behavior recorded for Chinese users is stored offshore. |
| What it records | An embedded agent keyed to a Visitor ID: page views (“the URL, some browser information, such as language and browser version”), clicks and focus events, plus visitor and account metadata you attach. “By default, Pendo captures IP address and geolocation information from the browser.” |
| How it's delivered | A snippet that “securely and asynchronously loads the Pendo Web SDK” (pendo.js) from cdn.pendo.io — a SDK Pendo says is “hosted and served on Amazon's Web Services (AWS) and Cloudfront Content Distribution Network (CDN),” an offshore edge the mainland reaches unevenly. |
| The cross-border trigger | Recording a China-based user moves their personal information out of the mainland — a cross-border transfer PIPL governs, calling for notice, separate consent and a transfer mechanism. |
| Who carries the duty | You, the site embedding the agent — not Pendo. For a CIIO or large-volume handler, personal information collected in China must be stored in the mainland. Pendo itself carries no ICP; that falls on your app. |
The agent records personal data — and drives your in-app experience with the same script
Pendo is not a passive metrics tag. One embedded agent does two jobs at once: it records what your users do — the pages they view, their clicks, the visitor and account IDs you assign — and it injects your in-app guides, walkthroughs and surveys back into the interface. Pendo’s own documentation describes an agent that collects events keyed to a Visitor ID and, “upon the loading of a page, … collects the URL, some browser information, such as language and browser version,” and it adds that “by default, Pendo captures IP address and geolocation information from the browser.” Attached to an identified visitor and account, that is personal information under China’s Personal Information Protection Law — not anonymous telemetry. And because the guides ride on the very same agent, how that script behaves inside China touches both halves of the question in one stroke: the data it takes out, and the experience it is supposed to deliver.
Your China users’ behavior is stored offshore
Where that recording lands is what turns an analytics feature into a compliance exposure. Pendo “uses Google Cloud Platform (GCP) as the underlying platform for storing and processing customer data,” separating it into environments in the United States, the European Union, Japan and Australia; a new account sits in the US environment, where data lives in “GCP’s US Multi-Region.” An EU environment is offered for customers who need it — one that “ensures that no personal data is stored outside of the EU” — but not one of the four environments is inside mainland China. So a session Pendo records from a mainland user is written to servers outside it. Under the Personal Information Protection Law that is a cross-border transfer, and the handler — you, the site embedding Pendo, not Pendo itself — has to give notice, obtain separate consent for the transfer, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification (PIPL Articles 38–43). The IP capture sharpens it, since location-grade data about a Chinese user is in the payload from the first page view. And if you are a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty that GCP’s US, EU, Japan and Australia regions cannot satisfy.
Reachable is the smaller half — and Pendo files no ICP for you
Whether the agent loads cleanly is a delivery question, and the smaller half of “does it work.” Pendo installs as a snippet that pulls pendo.js from its CDN on every page, and Pendo states the SDK is “hosted and served on Amazon’s Web Services (AWS) and Cloudfront Content Distribution Network (CDN)” — an offshore edge the mainland reaches unevenly. When that script is slow or fails to load, you lose more than a few analytics events: the same agent injects your in-app guides and surveys, so a stalled snippet can delay or break the guided experience it exists to drive. That is a genuine operational risk — but it is not the one that decides whether you may use Pendo at all. Pendo is not a public website you file an ICP for; it is a backend layer embedded in a site you operate, so it adds no ICP filing of its own under State Council Order No. 292 and MIIT Order No. 33 — that duty stays with your public-facing application. What Pendo adds to your China footprint is the cross-border data flow, opened the instant it records a mainland user. Reachability decides whether the recording and the guides arrive; PIPL decides whether you were allowed to collect in the first place.
This is a risk map, not a verdict: how much exposure you carry turns on what you capture, how much of it you tie to identified users, your role and data volumes, and who your users are — worth settling with counsel before you roll Pendo out at scale.
Where 21YunBox fits — a compliant overlay, not a migration
You keep Pendo exactly where it is. What we add is the compliance layer around it. Our China team maps what your agent actually captures from mainland users — visitor and account IDs, events, IP-derived location — and assesses the PIPL cross-border and data-residency exposure that creates for your entity and your data volumes; then we stand up the ICP-filed, in-country delivery a lawful China presence needs, set in front of your existing origin, with no rebuild, no second codebase and no move off the tools you run today. Pendo stays your product-experience platform; the cross-border and residency gaps become ours to map and close with you.
Related reading:
