Does PostHog Work in China? PIPL Cross-Border, Automated Decisions & Data Residency

For a product that runs PostHog for users in mainland China, the first question is usually whether its SDK and ingestion endpoints can be reached — and largely they can. But reachability is not where the China decision is made. What decides it is what happens to the user context and behavior you hand PostHog: the autocaptured events, the session recordings, the person properties, and the targeting context you send to evaluate a feature flag or an experiment. PostHog is a product-analytics platform — product analytics, session replay, feature flags, and experiments — and by default it runs on PostHog Cloud, hosted in the United States or the EU (Frankfurt), with no mainland-China region. That puts three distinct questions on the table: a cross-border transfer of your China users’ personal information, an automated decision about what each of them sees, and the consent and residency duties that follow.

PostHog in China at a glance

What you actually send — your users’ attributes and behavior

PostHog is not a page to render; it is an instrumentation layer that watches what your users do. Its SDKs autocapture behavioral events — pageviews, clicks, form interactions — and, with session replay enabled, take a full snapshot of the page’s DOM and record what changes thereafter. PostHog’s own privacy documentation is candid that “General text is not masked by default”; input fields are masked (“we mask these by default”), but a recording can still carry a great deal about a person. On top of the events, PostHog builds person profiles keyed to a distinct ID and enriched with person properties — and its GDPR docs say outright that “Names and email addresses are obviously personal data” and that “IP addresses can be considered personal data under GDPR.” For feature flags and experiments, your app sends the user’s targeting context — the distinct ID, person properties, and cohort membership — so PostHog can decide which flag value or experiment variant that user receives; the resulting exposure and experiment events stream back and are stored.

Where does all of it land? By default, on PostHog Cloud. PostHog’s GDPR guidance recommends “PostHog Cloud EU – a managed version of PostHog that’s hosted on servers based in Frankfurt,” and notes “you can use PostHog Cloud US” — those are the only two regions PostHog operates, and neither is in mainland China. So whether you pick US or EU, your China users’ events, recordings, and profiles rest offshore and keep accumulating. (Server-side SDKs can evaluate some flags locally by first downloading the flag definitions, but the person context and the analytics and exposure events are still sent to PostHog — local evaluation trims round-trips, not the data that reaches the vendor.)

It’s a cross-border transfer — and an automated decision — under PIPL

Two of China’s rules bite at once here, and most teams only see one. First, the cross-border transfer. The moment a person in mainland China is recorded, identified, or evaluated, you upload their behavioral data and attributes to PostHog’s US or EU infrastructure. Under the Personal Information Protection Law that is a cross-border transfer of personal information (数据出境), and the duty is on you, the handler — not on PostHog. Articles 38–40 require notice, a separate consent distinct from any general terms, and one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. Above the regulatory thresholds, or where the data qualifies as “important data,” the data-export security assessment (数据出境安全评估) may apply before anything leaves.

Second — and this is the prong unique to flags, experiments, and personalization — Article 24 governs automated decision-making. A feature flag that turns a capability on for one cohort and off for another, an experiment that assigns a variant, or a personalized experience driven by a person’s profile is a decision made automatically about what that individual sees, based on their characteristics. Article 24 requires that such decisioning be transparent and fair, that the individual can refuse it, and that where a decision or push is based on profiling, the individual is offered an option not to be targeted by their personal characteristics. Running an experiment on a China segment, or personalizing from a PostHog profile, is profiling under Article 24. Stacked on both is consent: session replay and non-essential analytics need a lawful basis and the user’s consent under Articles 13 and 23. And a growing offshore store of person profiles raises a residency question — the Cybersecurity Law’s Article 39 (formerly Article 37 — the data-localization article was renumbered by the 2025 amendment, in force since January 1, 2026, with its substance unchanged) requires personal information collected in China to be stored in China for a critical information infrastructure operator or high-volume handler. None of this turns on how fast the SDK answers; it turns on whether the data had a lawful basis to leave the country.

Reaching the SDK isn’t the question — keeping the decisioning in-country is

So “can we reach PostHog from China?” is the wrong test. The productive question is how to keep your China users’ data, and the decisions made from it, on a lawful, in-country footing — and PostHog gives you an unusually strong lever, because it is genuinely open-source. Its own documentation states “PostHog is open-source and freely available for anyone to host themselves,” with a Docker Compose deployment under an MIT license. That means the flag-evaluation and the event and profile store can, in principle, run inside China rather than offshore. Be clear-eyed about the current posture, though: PostHog now steers teams to PostHog Cloud and says self-hosted deployments are “officially unsupported,” with “no customer support for product, infrastructure, or other questions for self-hosted instances.” An in-country self-hosted deployment is therefore an operations commitment, not a checkbox.

The lawful path is to keep the decisioning and the user data on an in-country path — self-host the open-source engine in China where you have the capability to run and maintain it, or route China users through a licensed in-country experimentation and analytics alternative — while minimizing and pseudonymizing the targeting context you send (evaluate with the least identifying context, ideally no raw identifiers), obtaining the Article 13/23 consent, and honoring the Article 24 right to refuse profiling. What this is not is a tunnel that ships the same data offshore anyway; that keeps the SDK responsive and leaves every PIPL duty exactly where it was. This is a risk map, not a verdict: whether a transfer mechanism, in-country storage, or a reworked consent and opt-out flow applies to your deployment depends on what context and events you actually send, how much, and to whom — settle the specifics with counsel before you build.

The lawful path — map, localize, deliver

There is a lawful way to run product analytics, flags, and experiments for a China-facing product, and it has a shape. First, map: our China team inventories what you send PostHog — which events and recordings, which person properties, and the targeting context behind each flag and experiment — where it is evaluated and stored, how it is used to decide what each user sees, whether it is building a persistent offshore profile store, and on what consent basis. We frame the technical picture; you settle the legal conclusions with counsel.

Then localize: keep China-user flag-evaluation and data on an in-country path. Because PostHog is open-source, that can mean self-hosting the engine inside China where you have the operations capability to run and maintain it, or routing China users through a licensed in-country analytics and experimentation alternative — in either case minimizing and pseudonymizing the context you send, and honoring the Article 24 right to a non-profiled option. Localizing means keeping the decisioning and the user data on an in-country path — never a tunnel that ships the data offshore anyway. Where a license bears on the domestic alternative, that sits with a licensed domestic operator and your counsel; 21YunBox is advisory there.

Then deliver: the China-facing app that loads the PostHog SDK, runs the flags, and consumes the decisions is itself a public-facing service in the mainland, so it carries an ICP filing (备案) duty and needs compliant, in-country delivery — the 21YunBox Optimizer, in front of the stack you already run, with no rebuild and no re-platform. The result is a product-analytics and experimentation setup that runs legally and compliantly for your users in China. 21YunBox never uses or suggests circumvention of any kind. We are a compliant overlay and partner — not a competitor to PostHog.

Get a compliance assessment →

Related reading:

• Cross-border data transfers under PIPL
• China’s Cybersecurity Law (data localization, Article 39)
• China’s data-export security assessment
• How to get an ICP filing for China

RELATED TECHNOLOGIES

Heap

Heap

LaunchDarkly

LaunchDarkly

mParticle

mParticle

Split

Split

Statsig

Statsig