Does Squarespace Work in China? PIPL Cross-Border, ICP Filing & Data Residency

Squarespace is a fully hosted SaaS website and commerce builder with no mainland-China region, so your store's customer PII, orders and behavior sit on its offshore US servers — a PIPL cross-border transfer — the storefront needs an ICP filing, and China payment runs through a licensed domestic path. A compliance-first look at the residency, ICP and payment exposure.

By the 21YunBox Compliance Team · Reviewed 2026-10-10 · Verified against Squarespace's own documentation

Does Squarespace work in China?

A Squarespace store will usually load for shoppers in mainland China — but that is the easy half. Squarespace is a fully hosted SaaS platform with no mainland-China region; it states personal information may be transferred "to our servers in the US," so a China store's shopper PII and orders sit offshore, the storefront on Squarespace's domains can't be ICP-filed as-is, and China payment has to run through a licensed domestic path.

Every shopper account, order, shipping address and the behavior your store records is personal information under PIPL. Running a China-facing store on an offshore platform makes that a PIPL cross-border transfer (notice, a separate consent and a transfer mechanism, Articles 38–40), and a public storefront still owes an ICP filing bound to a mainland host. The lawful lever is to keep your China shoppers' PII and orders in-country and route China payment through a licensed domestic path — then ICP-file and deliver the storefront in-country — not to make the offshore storefront reachable (21YunBox is advisory on payment licensing).

This is a risk map, not a verdict — the residency, ICP and payment bar turns on your entity, your data volumes and who your shoppers are. Our China team can map your exposure →

What Squarespace's own documentation says about China

Fact	Primary source
Squarespace is a fully hosted, all-in-one SaaS platform — you don't run or place the store yourself. Its Privacy Policy defines an "End User" as someone who "visits, purchases from, makes a booking with" one of its Customers' sites that is "hosted on, our Services" — the storefront and its shopper data run on Squarespace's own infrastructure, with no self-hosting option and no region inside mainland China. That is the convenience and the constraint together: you cannot relocate a China store onto a licensed mainland host, which is exactly what an ICP filing must attach to.	Squarespace — Privacy Policy (squarespace.com/privacy), retrieved 2026-10-10
Squarespace stores personal information offshore — by its own account, on its servers in the US. The Privacy Policy, under "Data transfers," states: "Your personal information may be transferred to countries other than where you live, such as, for example, to our servers in the US," and that it may go "to countries that do not have the same data protection laws as the country in which you initially provided the information." For a China-facing store, shopper accounts, orders and addresses living in the US is a cross-border transfer of personal information under PIPL.	Squarespace — Privacy Policy, "Data transfers" section (squarespace.com/privacy), retrieved 2026-10-10
Running a China store on an offshore platform is a cross-border transfer you — the handler — must legalize. PIPL Articles 38–40 require notice, a separate consent (Articles 13 and 23) and one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification) before your China shoppers' personal information leaves the mainland. A critical information infrastructure operator or high-volume handler must store that data in China under Cybersecurity Law Article 39 (formerly Article 37) — a residency duty an offshore region can't meet.	PIPL Articles 13, 23 & 38–40; Cybersecurity Law Article 39 (formerly Article 37)
A China-facing storefront is a public internet service that needs an ICP filing — and a foreign SaaS store can't carry one. Public sites served to mainland users require an ICP filing (备案) bound to a licensed mainland hosting resource under State Council Order No. 292 and MIIT Order No. 33; a commercial store that takes orders can raise the bar to a commercial ICP license (ICP 证). A storefront on Squarespace's offshore domains and CDN has no mainland host to file against.	State Council Order No. 292; MIIT Order No. 33 — see /china-icp-license-website.html, retrieved 2026-10-10

Sources verified by the 21YunBox compliance team on 2026-10-10.

For a mainland-China audience, the deciding question about Squarespace is not whether your storefront paints on screen — it is where your customers’ personal information, orders and browsing behavior are allowed to live, whether a public store can be ICP-filed, and how shoppers in China are meant to pay. Squarespace answers the first part in its own documentation: it is a fully hosted, all-in-one SaaS website and commerce builder with no self-hosting option and no region inside mainland China, and it states that your personal information “may be transferred to countries other than where you live, such as, for example, to our servers in the US.” A China-facing Squarespace store is therefore served and stored offshore. That turns every shopper account, order and address into a cross-border transfer under PIPL, leaves the storefront with no mainland host to anchor an ICP filing, and routes checkout through Western processors rather than China’s licensed domestic payment. Loading is the easy half; residency, licensing and payment are the exposure.

Squarespace's Privacy Policy, Data transfers section, stating that a user's personal information may be transferred to countries other than where they live, such as to Squarespace's servers in the US, and to countries that do not have the same data protection laws. — "Your personal information may be transferred to countries other than where you live, such as, for example, to our servers in the US." Squarespace's own Privacy Policy places your shoppers' data offshore — for a China-facing store, that offshore location is the PIPL cross-border question in its own words. Source: squarespace.com/privacy

Squarespace in China at a glance

What decides it	In Squarespace's own terms — and China's law
What it holds	Your store collects shopper names, shipping addresses, phone numbers, emails, order history and browsing behavior. Squarespace defines an "End User" as someone who "visits, purchases from, makes a booking with" one of its Customers' sites that is "hosted on, our Services." All of it is personal information under PIPL.
Where it runs	A fully hosted, all-in-one SaaS platform with no self-hosting option; Squarespace states personal information may be transferred "to our servers in the US," and it runs no region inside mainland China. Run for China shoppers, that offshore storage is a cross-border transfer of personal information — a 数据出境 under PIPL Articles 38–40.
Serving the public (ICP)	A public storefront for mainland shoppers needs an ICP filing (备案) bound to a mainland host — and, because it sells, potentially a commercial ICP license. A foreign SaaS storefront on Squarespace's own domains and CDN cannot be ICP-filed as-is.
Payment & residency	Squarespace runs checkout through Western processors — "Stripe, Square, PayPal, Afterpay, and ClearPay" plus Squarespace Payments. The domestic methods Chinese shoppers expect run through licensed domestic payment, which a foreign platform cannot provide directly. A CIIO or high-volume handler must also store China personal information in-country (Cybersecurity Law Article 39, formerly Article 37).
Reachability is not the axis	A storefront can load for mainland shoppers, but that is delivery, not clearance. The lawful lever is to keep China shoppers' PII and orders on an in-country path, ICP-file and deliver the storefront in-country, and route China payment through a licensed domestic path — 21YunBox is advisory on payment licensing.

What you actually hold — customer PII, orders and behavior

A Squarespace store is not a brochure; it is a book of record on your customers. Every account holds a name, shipping and billing addresses, a phone number and an email; every checkout adds an order history and payment identifiers; and the site quietly records browsing and behavioral data on top. Under China’s Personal Information Protection Law all of that is personal information, and for a China-facing store it describes people in the mainland.

Squarespace is, by its own account, a fully hosted SaaS platform: its Privacy Policy defines an “End User” as someone who uses “one of our Customer’s sites” that is “hosted on, our Services.” You do not choose or control the host, and there is no self-hosting option — so you cannot place a China store on a licensed mainland server. That matters because Squarespace also states that your personal information “may be transferred to countries other than where you live, such as, for example, to our servers in the US,” and “to countries that do not have the same data protection laws as the country in which you initially provided the information.” The store data lives where Squarespace runs — offshore, in the US — not in the mainland.

Three doors: cross-border customer data, an ICP-filed storefront, and licensed payment

Door one — cross-border customer data. Serve China from Squarespace and your shoppers’ accounts, orders and addresses are stored offshore. Under PIPL that is a cross-border transfer (数据出境), and the handler — you, not Squarespace — must give notice, obtain a separate consent (Articles 13 and 23), and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification (Articles 38–40). If you are a critical information infrastructure operator or a high-volume handler, personal information collected in China must be stored in the mainland under Cybersecurity Law Article 39 (formerly Article 37) — the 2025 Cybersecurity Law amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39, substance unchanged — a residency duty an offshore Squarespace region cannot meet. E-commerce handlers routinely cross those volume thresholds.

Door two — the storefront is a public site. A commercial store delivered to mainland shoppers is a public internet service, and public sites in China turn on an ICP filing (备案) bound to a hosting resource physically inside the mainland, under State Council Order No. 292 and MIIT Order No. 33. Because the store sells, the bar can rise from the basic recordal to a commercial ICP license (ICP 证). A storefront served from Squarespace’s offshore domains and CDN has no mainland host to file against, and you cannot relocate it onto one.

Door three — payment. Squarespace runs checkout through Stripe, Square, PayPal, Afterpay and ClearPay, plus its own Squarespace Payments — all Western rails. The payment methods Chinese shoppers actually reach for run through licensed domestic payment, a regulated non-bank-payment activity a foreign platform cannot provide directly, and China’s E-Commerce Law adds its own platform and consumer-protection duties. This is the advisory leg: the lawful route is a licensed domestic payment path, which 21YunBox helps you plan rather than hold a license for.

Reaching the storefront isn’t the question — a compliant in-country store is

A Squarespace storefront is not categorically blocked, and where it loads for mainland shoppers that is a genuine convenience. But reachability is the delivery half of the question, and it leaves the legal half untouched: a store served from offshore still keeps its shoppers’ data outside the mainland, still has no ICP filing, and still cannot take licensed domestic payment on its own. On a fully hosted SaaS with no self-hosting option, those gaps are structural, not a setting you can tune — and the fix is to keep the store’s customer data on an in-country path with ICP-filed, in-country delivery and a licensed domestic payment path, not to make the offshore store merely reachable.

This is a risk map, not a verdict: whether a commercial ICP, in-country storage, or a particular payment arrangement applies depends on what you sell, how much personal data you hold, and who your shoppers are — worth settling the specifics with counsel before you build.

The lawful path — map, localize, deliver

You keep building and selling on Squarespace. 21YunBox adds the compliance overlay a hosted SaaS with no mainland presence cannot — no rebuild, no migration, no second codebase:

Map — inventory the customer PII, orders, behavioral data and payment flows your store holds, where Squarespace processes and stores them (offshore, in the US — no mainland-China region), whether the storefront is ICP-filed, and your consent basis.
Localize / govern — keep your China-customer PII and orders on an in-country path (a licensed in-country deployment, since Squarespace offers no self-hosting), minimize and pseudonymize, obtain the Article 13/23 consent, and route China payment through a licensed domestic path. Localize means keeping the store data in-country — never shipping it back offshore.
Deliver — the storefront is a public site that carries an ICP filing duty and needs compliant, in-country delivery (the 21YunBox Optimizer), in front of the Squarespace stack you already run.

21YunBox never uses or suggests circumvention of any kind. The goal is a store that runs legally and compliantly for your users in China — 21YunBox is a compliance overlay and partner, advisory on payment licensing, not a competitor to Squarespace.

Get a compliance assessment →

Related reading:

Frequently Asked Questions

Can we get an ICP filing for our Squarespace store?

Not for the store as Squarespace hosts it. An ICP filing has to attach to a hosting resource physically inside mainland China, and Squarespace is a fully hosted SaaS platform with no mainland-China region and no self-hosting option — there is no mainland host to file against, and you can't relocate the store onto one. The usual path is to keep your Squarespace storefront where it is and place ICP-filed, in-country delivery in front of it, with your China shoppers' PII and orders kept on an in-country path.

Where does Squarespace store our shoppers' data, and is that a problem for China?

Squarespace's Privacy Policy says personal information may be transferred "to our servers in the US" and to countries without the same data protection laws. For a China-facing store, shopper accounts, orders and addresses are personal information living offshore, which PIPL governs as a cross-border transfer (notice, a separate consent and a transfer mechanism). Whether an in-country storage duty also applies turns on your role and data volumes — settle it with counsel.

Can shoppers in China pay, and can 21YunBox help?

Squarespace runs checkout through Western processors — Stripe, Square, PayPal, Afterpay and ClearPay, plus Squarespace Payments — none of which provides China's licensed domestic payment directly. Our China team can map your PIPL cross-border, ICP and payment exposure, keep your store data on an in-country path, and stand up ICP-filed in-country delivery in front of the Squarespace store you already run, while advising on routing China payment through a licensed domestic path. Get in touch to work through your case.