Does Spline Work in China? ICP, Data Residency & the Offshore Embed
Spline runs no mainland-China region — your scenes, account and content sit on US servers, and an embedded scene is fetched from Spline's offshore cloud. So the ICP filing stays on the site that embeds it, and any personal data it holds is a PIPL cross-border transfer. A compliance-first look.
Does Spline work in China?
Yes — a Spline scene embeds and loads for mainland visitors, but "does it work" and "is it compliant" split here. Spline is an offshore, US-hosted asset layer, so the ICP filing sits on the website that embeds your scene, not on Spline; and because Spline runs no mainland-China region, your scenes and account data live on US servers, which is where the real exposure sits.
Spline's own privacy policy states it is "primarily operated and managed on servers located and operated within the United States," that "The hosting facilities for your Personal Information are in the United States," and that your information "will be processed in the United States" — it documents no China region. The scene is fetched from Spline's cloud (prod.spline.design) each time your page loads, so for a plain published embed the live question is reachability plus the ICP filing your own site must hold (State Council Order No. 292; MIIT Order No. 33) — Spline is a backend asset, not the thing that gets filed. Add accounts, collaboration or viewer analytics and your users' personal information moving to those US servers becomes a cross-border transfer PIPL governs (Articles 38–43). The table below is Spline's own wording and the rule each point triggers.
This is a risk map, not a verdict — whether the PIPL door bites turns on what personal data your embed and account actually touch. Our China team can map your exposure with you →
Compliance snapshot
- ! Spline runs no mainland-China region — scenes and account data sit on US servers
- ✕ Spline itself can't be ICP-filed — it's an offshore editor and asset host, not your origin
- ! A public site embedding a Spline scene for the mainland still needs its own ICP filing
- ! Any account or viewer personal data on US servers is a PIPL cross-border transfer
- ✓ You can self-host the scene file, moving embed delivery off Spline's offshore cloud
What Spline's own documentation says about China
| Fact | Primary source |
|---|---|
| Spline stores your data on US servers — it documents no mainland-China region. Its privacy policy states the company is "primarily operated and managed on servers located and operated within the United States," that "The hosting facilities for your Personal Information are in the United States," and that "your Personal Information will be processed in the United States." Nothing in the policy describes a China region or in-country storage, so your scenes, account and collaboration data sit offshore. | Spline — Privacy Policy (spline.design/privacy), last modified 2026-09-29, retrieved 2026-10-07 |
An embedded scene is fetched from Spline's offshore cloud at view time. Spline's runtime loads a scene with spline.load('https://prod.spline.design/…/scene.splinecode'), and its docs note the file "will be loaded through a fetch call." That makes a Spline embed a backend asset-delivery layer sitting behind your page — so a public mainland site that embeds it still needs its own ICP filing (State Council Order No. 292; MIIT Order No. 33); the filing attaches to your site, not to Spline, which cannot carry one. | Spline — @splinetool/runtime README (unpkg.com, Spline's official npm package), retrieved 2026-10-07; State Council Order No. 292; MIIT Order No. 33 |
| Spline lets you self-host the scene file. Its own docs say "you can download the .splinecode file and self-host it," which lifts the embed's delivery off Spline's US cloud and onto an origin you control — the one point you can place inside the mainland behind an ICP filing. The editor, your account and collaboration still live on Spline's US servers; only the delivered asset need move. | Spline — @splinetool/runtime README (unpkg.com, Spline's official npm package), retrieved 2026-10-07 |
| Account and content data on US servers is a cross-border transfer — and may reach AI partners. Spline says it "may send and store your Personal Information outside of the country where you reside or are located," retains it "for as long as you have a Spline member account," and may share content with "third-party partners, including artificial intelligence and machine learning companies" (AI training is "on by default for individual accounts"). To the extent your account data, or any analytics the embed gathers on mainland viewers, holds personal information, moving it to those US servers is a cross-border transfer under PIPL (Articles 38–43), needing notice, separate consent and a transfer mechanism. | Spline — Privacy Policy (spline.design/privacy), last modified 2026-09-29, retrieved 2026-10-07; PIPL Articles 38–43 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, “does Spline work” splits into two questions: can the 3D scene load, and are you cleared to serve it. Spline answers the second in its own documentation. It runs no region inside mainland China — its privacy policy puts its servers, hosting facilities and data processing in the United States — and an embedded scene is fetched from that offshore cloud each time your page loads. That makes a Spline embed a backend asset sitting behind your page, not your hosting origin: so reachability is the delivery half, while the compliance half is that the site embedding it still needs its own ICP filing, and any personal data Spline holds for you lands outside the mainland under China’s privacy law.
Spline in China at a glance
| What decides it | In Spline's own terms |
|---|---|
| Where it runs | Spline is a browser-based editor; its privacy policy says it is “primarily operated and managed on servers located and operated within the United States.” No region is inside mainland China. |
| Where your data lives | “The hosting facilities for your Personal Information are in the United States,” and your information “will be processed in the United States.” Scenes, accounts and collaboration data sit offshore. |
| The embed | An embedded scene is fetched from Spline's cloud (prod.spline.design) at view time — a backend asset behind your page, not your hosting origin. |
| Serving the public | A public mainland site that embeds Spline still needs its own ICP filing. Spline is the asset; your site is the thing that gets filed, and Spline cannot carry a filing for you. |
| Your data under PIPL | Account data and any viewer analytics reaching US servers is a cross-border transfer of personal information PIPL governs; content may also be shared with “artificial intelligence and machine learning companies.” |
No mainland region — Spline lives in the US
Spline is a cloud editor you run in the browser, and in its own privacy policy it is “primarily operated and managed on servers located and operated within the United States.” It adds that “The hosting facilities for your Personal Information are in the United States” and that your information “will be processed in the United States.” Nowhere does the policy describe a mainland-China region or in-country storage. So your scenes, your account and your collaboration history live offshore — not as a stance against China, but because the United States is the only home Spline documents.
The embed is a backend asset — so the ICP filing is on your site
When you publish a scene, the viewer or runtime fetches it from Spline’s cloud — the runtime loads it with spline.load('https://prod.spline.design/…/scene.splinecode'), and Spline notes the file “will be loaded through a fetch call.” That makes an embedded Spline scene a backend asset-delivery layer sitting behind your page, the same shape as a web font or a third-party script. The consequence for China is specific: the thing that needs an ICP filing — under State Council Order No. 292 and MIIT Order No. 33 — is the public website that serves mainland visitors, not Spline. Spline cannot hold your ICP filing and does not relieve you of one; if your site is served to the mainland public, it needs its own filing whether or not a 3D scene is embedded on it.
There is one lever Spline hands you here. Its own docs say “you can download the .splinecode file and self-host it,” which lifts the scene’s delivery off Spline’s offshore cloud and onto an origin you control — the one point you can place inside the mainland behind an ICP filing. The editor and your account stay on Spline’s US cloud; the delivered asset need not.
Accounts, content and viewer data — the PIPL half
For a plain published scene that carries no end-user personal information, that is most of the story: reachability plus your own site’s ICP filing, much like any offshore asset on the page. The picture changes the moment personal data is involved. Spline says it “may send and store your Personal Information outside of the country where you reside or are located,” retains it “for as long as you have a Spline member account,” and may share content with “third-party partners, including artificial intelligence and machine learning companies” — with AI training “on by default for individual accounts.” To the extent your account details, your design content, or any analytics the embed gathers on mainland viewers contain personal information, moving that to US servers is a cross-border transfer under PIPL (Articles 38–43): you owe notice, separate consent and one transfer mechanism. And for a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty an offshore, US-hosted tool cannot meet.
This is a risk map, not a verdict: whether the ICP door, the PIPL door, or only the delivery question applies turns on what your embed actually serves and what personal data it touches — worth settling with counsel before you ship.
Where 21YunBox fits — a compliant overlay, not a migration
You keep designing in Spline. We add the piece an offshore, US-hosted tool cannot give a China-facing site: compliant, ICP-filed delivery from inside the mainland, set in front of the origin that embeds your scene — no rebuild, no second codebase, and no move off Spline. Where it helps, that includes serving a self-hosted copy of your .splinecode scene from in-country, so the asset your visitors fetch no longer has to cross the border. Our China team maps which half of the question is yours — the ICP filing on your embedding site, or the PIPL cross-border exposure once accounts and viewer data are in play — and stands up the in-country delivery and the filing path a lawful China presence needs.
Related reading:
Frequently Asked Questions
Does embedding a Spline scene mean my site needs an ICP filing?
Not because of Spline itself — but likely because of your site. Spline is an offshore, embedded asset: the 3D scene is fetched from Spline's cloud and sits behind your page, so the ICP obligation attaches to the public website that serves mainland visitors, not to Spline. If that site is served to the mainland public, it needs its own ICP filing under State Council Order No. 292 and MIIT Order No. 33, whether or not a Spline scene is embedded on it. Treat Spline like any third-party asset on the page and settle the ICP question at the site level with counsel.
Does a Spline embed raise PIPL cross-border issues?
It depends on what personal data it touches. A plain published 3D scene that carries no end-user personal information is closer to a static asset — there the main question is reachability from the mainland. But Spline stores your scenes, account and collaboration data on US servers, and its policy allows sharing content with AI and machine-learning partners; to the extent your account data, or any viewer analytics the embed collects, holds personal information, moving it to those US servers is a cross-border transfer under PIPL (Articles 38–43), which calls for notice, separate consent and a transfer mechanism. Whether that bites is worth confirming with counsel.
Can 21YunBox help make our Spline embed work in China?
Yes. Our China team can map which half of the question is yours — reachability and your own ICP filing for a published embed, or PIPL cross-border exposure once accounts and viewer data are in play — and stand up ICP-filed, in-country delivery in front of the site that embeds Spline, including serving a self-hosted copy of the scene file from inside the mainland. You keep designing in Spline; the compliant delivery and the filing sit on your origin. Get in touch to work through your specific case.
