Does Salesforce Marketing Cloud Work in China? PIPL, Subscriber Data Residency & the Alibaba Cloud Nuance
Salesforce Marketing Cloud holds your subscribers' emails, mobile numbers and engagement profiles — and Salesforce's own mainland-China offering on Alibaba Cloud names Sales Cloud, Service Cloud and the Platform, not Marketing Cloud. So a China audience's subscriber data is held offshore: a cross-border transfer under PIPL that needs a separate consent and a transfer mechanism. A compliance-first look at the doors.
Does Salesforce Marketing Cloud work in China?
Whether you can use Salesforce Marketing Cloud for a mainland-China audience is first a data-residency and consent question under PIPL, not a speed one. Marketing Cloud is email, SMS and journey automation — it holds your subscribers' email addresses, mobile numbers and the engagement profile built on every open, click and journey — and where it keeps that personal data is what China's law responds to.
Salesforce does run inside mainland China, but on a separate, partner-operated path — and its own December 2023 announcement names "Salesforce Sales Cloud, Salesforce Service Cloud, and Salesforce Platform" on Alibaba Cloud, not Marketing Cloud. So a Marketing Cloud audience's subscriber data is held on Salesforce's infrastructure outside the mainland: a cross-border transfer of personal information PIPL governs, needing notice, a separate consent for the transfer on top of any marketing opt-in, one transfer mechanism, and — for a CIIO or large-volume handler — in-country storage. The table below is Salesforce's own wording and the rules it triggers.
This is a risk picture, not a verdict — your obligations turn on your subscriber volumes and your role. Our China team can map your Marketing Cloud exposure with you →
Compliance snapshot
- ! Subscriber data (emails, mobile numbers, engagement, journeys) is held on Salesforce's offshore infrastructure — not the mainland
- ! Loading China subscribers into Marketing Cloud is a cross-border transfer of personal information — PIPL applies
- ! Marketing consent plus a separate consent for the cross-border transfer are both required (PIPL Art. 39)
- ✕ Salesforce's mainland Alibaba Cloud instance names Sales, Service and Platform — not Marketing Cloud (GA Dec 18, 2023)
- ✓ A compliant, ICP-filed in-country delivery and storage path exists — an overlay on your setup, no rebuild
What Salesforce Marketing Cloud's own documentation says about China
| Fact | Primary source |
|---|---|
| In Salesforce's own announcement, "Salesforce Sales Cloud, Salesforce Service Cloud, and Salesforce Platform" went generally available "on Alibaba Cloud starting December 18, 2023," and "Exclusive features for mainland China will be available on Sales Cloud and Service Cloud hosted on Alibaba Cloud," to "help comply with the latest data residency regulations." Marketing Cloud is not named in that mainland offering, so the Alibaba Cloud instance is not an announced home for your Marketing Cloud subscriber data. | Salesforce Newsroom — Salesforce Sales and Service Cloud on Alibaba Cloud, December 18, 2023 (retrieved 2026-10-08) |
| A Marketing Cloud audience is personal information — email addresses, mobile numbers, and the opens, clicks, journey history and behavioral profile recorded against each contact. Collecting that from people in mainland China and loading it into Marketing Cloud sends it offshore, which PIPL governs as a cross-border transfer: the personal-information handler (you, Salesforce's customer — not Salesforce) must give notice, obtain separate consent for the transfer, and satisfy one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification. | PIPL Chapter III, Articles 38–39 |
| Marketing is consent-gated, and the cross-border transfer needs a second, separate consent. Under PIPL, sending commercial email, SMS or push to a contact and profiling them rests on that individual's consent; where the personal information is then provided outside the mainland, Article 39 requires a distinct, separate consent for the cross-border transfer — a general marketing opt-in does not cover it. For a platform whose whole function is holding and acting on subscriber data from offshore, that second consent is the sharp edge. | PIPL Articles 13–14 (consent) and Article 39 (separate consent for cross-border provision) |
| For a CIIO or large-volume handler, personal information collected in China must be stored inside mainland China (CSL Article 39 (formerly Article 37); PIPL Article 40) — a residency duty offshore infrastructure cannot meet. Exposure scales with volume: under the CAC's March 2024 cross-border rules, a non-CIIO transferring fewer than 100,000 individuals' non-sensitive personal information in a calendar year is exempt from the security assessment, standard contract and certification (notice and separate consent still apply). And where Marketing Cloud serves something public-facing to mainland visitors — a CloudPages landing page, a hosted form, a preference center — serving it from inside China attaches to an ICP filing (State Council Order No. 292; MIIT Order No. 33), which offshore infrastructure has no footing for. | PIPL Article 40; CSL Article 39 (formerly Article 37); CAC — Provisions on Promoting and Regulating Cross-border Data Flows (March 2024); State Council Order No. 292; MIIT Order No. 33 |
Sources verified by the 21YunBox compliance team on 2026-10-08.
For a mainland-China audience, the deciding question about Salesforce Marketing Cloud is not how quickly a journey fires — it is where your subscribers’ personal information is allowed to live, and on what consent it was sent there. Marketing Cloud is email, SMS and journey automation: its job is to hold your contacts’ email addresses, mobile numbers and the engagement profile built on every open, click and journey, then act on them. Salesforce does run inside mainland China — but on a separate Alibaba Cloud instance, and its own announcement of that instance names Sales Cloud, Service Cloud and the Salesforce Platform, not Marketing Cloud. So for a Marketing Cloud audience the data sits offshore, which turns every China subscriber you collect into a cross-border transfer of personal information China’s law governs — and makes the consent behind that transfer, not the load time, the thing that decides whether you may use it.
Salesforce Marketing Cloud in China at a glance
| What decides it | What it means for mainland China |
|---|---|
| Where your subscriber data lives | Salesforce's announced mainland instance — Sales Cloud, Service Cloud and the Platform “on Alibaba Cloud” — does not name Marketing Cloud. So your Marketing Cloud audience is held on Salesforce's offshore infrastructure, outside mainland China. |
| What Marketing Cloud holds | Your audience is personal information — email addresses, mobile numbers, and the opens, clicks, journeys and behavioral profile recorded against each contact. Loading a China subscriber into Marketing Cloud moves that offshore. |
| The cross-border transfer | PIPL governs it. The handler — you, not Salesforce — must give notice, obtain a separate consent for the transfer, and satisfy one mechanism: a CAC security assessment, the CAC standard contract, or certification. |
| Consent, twice | Marketing rests on the contact's consent; PIPL Article 39 requires a distinct, separate consent before that data is sent abroad. A marketing opt-in does not cover the cross-border transfer. |
| Data residency | For a CIIO or large-volume handler, personal information collected in China must stay in the mainland (PIPL Article 40; CSL Article 39 (formerly Article 37)) — which offshore infrastructure cannot satisfy. |
| CloudPages, forms & sends | Marketing Cloud's CloudPages, hosted landing pages, preference centers, tracking pixels and the email, SMS and push it dispatches all originate offshore; a public page shown to mainland visitors attaches to an ICP filing, and whether sends arrive reliably is a separate delivery question. |
Door one — Marketing Cloud holds your subscribers’ data offshore
Start with where the data lives, because that is what China’s law answers to. Salesforce Marketing Cloud is email, SMS and journey automation, and your audience inside it is personal information — email addresses, mobile numbers, and the opens, clicks, journey history and behavioral profile recorded against each contact. Salesforce’s own announcement of its mainland-China offering names Sales Cloud, Service Cloud and the Salesforce Platform on Alibaba Cloud; it does not name Marketing Cloud. So absent a specific in-country arrangement, your Marketing Cloud audience is held on Salesforce’s infrastructure outside the mainland — and the moment you collect a China subscriber and load it into Marketing Cloud, that personal information leaves the country.
Under China’s Personal Information Protection Law that is a cross-border transfer, and the handler — you, Salesforce’s customer, not Salesforce — must give notice, obtain separate consent, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. If you are a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty offshore infrastructure cannot meet.
Door two — consent, and then a second consent
This is where a marketing platform parts company with a passive host. Marketing already rests on consent in China: sending commercial email, SMS or push to a contact and profiling them depends on that individual’s agreement. PIPL then adds a requirement on top — Article 39 calls for a distinct, separate consent before personal information is provided to anyone outside the mainland. A general “subscribe” opt-in does not satisfy it. So for Marketing Cloud specifically, two consents stack: one to market to the contact, and a separate one to send that contact’s data across the border to Salesforce’s offshore infrastructure. Building a China audience in Marketing Cloud without that second consent is the most common quiet exposure, precisely because every journey keeps firing perfectly while it happens.
The mainland path is Sales and Service Cloud — not Marketing Cloud
Salesforce does run inside mainland China — but it is worth being exact about what that covers. By Salesforce’s own announcement, Sales Cloud, Service Cloud and the Salesforce Platform became generally available “on Alibaba Cloud starting December 18, 2023,” and “Exclusive features for mainland China will be available on Sales Cloud and Service Cloud hosted on Alibaba Cloud,” expressly to “help comply with the latest data residency regulations.” Marketing Cloud is not in that list.
So “we already run Salesforce in China” does not carry Marketing Cloud with it. The mainland instance Salesforce has announced is a separate, partner-operated deployment of Sales and Service Cloud and the Platform — not the Marketing Cloud your campaigns run on, and not a setting you switch on. Being reachable from Shanghai and being hosted on the mainland are different things, and for Marketing Cloud the data is, on the public record, in the first place and not the second.
When an ICP filing enters — CloudPages, forms and the sends into China
Data residency is one door; operating a public-facing service is another. A Marketing Cloud setup used only to send to a list turns mostly on the residency and consent rules above. But the moment Marketing Cloud serves something shown to mainland visitors — a CloudPages landing page, a hosted web form, a subscriber preference center — serving that experience from inside China attaches to an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, and that filing must bind to a hosting resource physically in the mainland. Offshore infrastructure has no mainland footing to file against.
Delivery is a further, separate question. Marketing Cloud’s hosted pages, tracking pixels and the email, SMS and push it dispatches all originate from offshore infrastructure, and whether they render and arrive reliably for a recipient inside the mainland depends on distance, third-party dependencies and network conditions. We publish no first-party measurement of Marketing Cloud delivery from inside China, so we put no figures here; it is something we would measure against your actual pages and sends rather than assert. What tuning cannot change is the first half: reaching Marketing Cloud still holds and moves your China subscribers’ personal data offshore.
This is a risk map, not a verdict: whether you need a transfer mechanism, in-country storage, an ICP filing, a reworked consent flow, or some combination depends on what you collect, how much of it, and who your contacts are — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep running your campaigns on Salesforce Marketing Cloud. We add the piece an offshore marketing platform cannot provide on its own: compliant, ICP-filed delivery from inside the mainland for the CloudPages, forms and preference centers your China audience actually touches, and in-country storage where the law requires your China subscribers’ data to stay on Chinese soil — placed in front of your existing setup, with no rebuild, no second codebase, and no migration off Marketing Cloud. Our China team maps your PIPL cross-border, consent and data-residency obligations against your entity and subscriber volumes, then stands up the in-country delivery and storage a lawful China presence needs, while Marketing Cloud stays exactly where it already runs.
Related reading:
Frequently Asked Questions
Does Salesforce Marketing Cloud store Chinese subscribers' data in China?
Salesforce's publicly announced mainland instance — Sales Cloud, Service Cloud and the Salesforce Platform on Alibaba Cloud since December 18, 2023 — does not name Marketing Cloud. So absent a specific in-country arrangement, a Marketing Cloud audience's subscriber data (emails, mobile numbers and engagement profiles) is held on Salesforce's infrastructure outside mainland China. Loading China subscribers into it is therefore a cross-border transfer of personal information under PIPL.
Is it against the law to use Salesforce Marketing Cloud for China contacts?
Not inherently. The issue is the cross-border transfer of personal information, which PIPL permits if you give notice, obtain a separate consent for the transfer, and meet one of its transfer mechanisms — and because this is marketing, the consent to message a contact and the consent to send their data abroad are two separate things. Whether a data-localization duty also applies turns on your role (for example, whether you are a CIIO) and your subscriber volumes. Treat this as a risk to assess with counsel, not a blanket prohibition.
Can 21YunBox help make our Salesforce Marketing Cloud setup compliant in China?
Yes. Our China team can help you assess the cross-border, consent and residency exposure for your subscriber volumes and role, and — where Marketing Cloud serves CloudPages, forms or preference centers to mainland visitors — stand up the compliant, ICP-filed in-country delivery, plus in-country storage where the law requires your China subscribers' data to stay on the mainland, while you keep running your campaigns on Marketing Cloud. Get in touch to work through your specific case.
