Does The Trade Desk Work in China? PIPL Cross-Border, Profiling Consent & Data Transfer

The Trade Desk is a demand-side platform whose Universal Pixel logs mainland visitors' behavioral data — page views, conversions, cookie and device IDs, IP address, and a hashed-email UID2 identity — and sends it to its offshore ad servers to build cross-site profiles. A compliance-first look at the PIPL cross-border transfer, Article 24 profiling, and separate-consent exposure.

By the 21YunBox Compliance Team · Reviewed 2026-10-10 · Verified against The Trade Desk's own documentation

Does The Trade Desk work in China?

The real exposure is not adding the tag — it is that The Trade Desk's Universal Pixel fires on your mainland visitors and sends their behavioral data to offshore ad servers to build cross-site profiles. The Trade Desk generally resolves from the mainland, so this is a live compliance problem, not a reachability one.

On each mainland visitor the pixel can collect IP address, cookie and device identifiers, pages and conversions, and — through UID2 — an identity derived from a hashed email, then send it offshore (The Trade Desk's own policy: "We may transfer data from the country of origin to the US or other countries"). That makes it a PIPL cross-border transfer (Articles 38–40: notice, a separate consent, and one transfer mechanism) and an Article 24 automated-decision-making mechanism that needs its own transparency and separate consent (Articles 13/23). The lawful lever is not to make the offshore pixel load in China — it is to gate or suppress it for mainland visitors, honor consent, and route any advertising you still need to Chinese users through a licensed in-country alternative.

What you actually owe turns on your entity, your volumes, and whose data the pixel touches — a risk to settle with counsel. Our China team can map your exposure →

What The Trade Desk's own documentation says about China

Fact	Primary source
The Universal Pixel collects behavioral personal information and sends it to The Trade Desk. The Trade Desk's privacy policy lists what the platform ingests, including "IP addresses," "unique cookie identifiers," "device advertising identifiers," "web browsing history from advertising impressions we see," and "hashed email addresses and other identifying information," gathered via "Pixels and cookies, which allow us to recognize web browsers across sites and over time."	The Trade Desk, "Privacy and The Trade Desk Platform" (thetradedesk.com/us/legal/privacy), retrieved 2026-10-10
UID2 builds a persistent, cross-site identity from a hashed email — still personal data under PIPL. The Unified ID 2.0 documentation The Trade Desk stewards states that "An email hash is a Base64-encoded SHA-256 hash of a normalized email address," and that normalizing before hashing "ensures that the generated UID2 value will always be the same, so that the data can be matched" — a deterministic, re-identifiable identifier, not anonymization.	Unified ID 2.0 documentation, "Normalization and Encoding" (unifiedid.com), retrieved 2026-10-10
The data is processed offshore, with no mainland-China region. The Trade Desk's privacy policy states, "We may transfer data from the country of origin to the US or other countries," and names its transfer bases as the EU-U.S. and Swiss-U.S. Data Privacy Frameworks and the "APEC Cross Border Privacy Rules System" — US, EU and APEC footings, none in mainland China. Sending a mainland visitor's data there is a cross-border transfer under PIPL.	The Trade Desk, "Privacy and The Trade Desk Platform" — International Transfers (thetradedesk.com), retrieved 2026-10-10
The transfer, the profiling, and the tracking each carry a PIPL duty. Exporting the data triggers Articles 38–40 (notice, a separate consent, one transfer mechanism); targeting from cross-site profiles is automated decision-making under Article 24 (transparency, fairness, a right to refuse); and the behavioral tracking itself needs a consent basis under Article 13, with a separate consent for the cross-border leg (Articles 23 and 39).	Personal Information Protection Law of the PRC, Articles 13, 23, 24, 38–40 (cac.gov.cn), retrieved 2026-10-10

Sources verified by the 21YunBox compliance team on 2026-10-10.

For a brand serving mainland China, the question about The Trade Desk was never whether you can add its tag — you add the Universal Pixel and it loads. The real question is what happens when it fires on a visitor in China. The Trade Desk is a demand-side platform, and its Universal Pixel is a site-side conversion-and-retargeting tag: on each visitor it records behavioral personal information — pages and conversions, cookie and device identifiers, IP address, and, through Unified ID 2.0 (UID2), an identity derived from a hashed email — then sends it to The Trade Desk’s servers to build cross-site profiles for ad targeting. Because the platform generally resolves from the mainland, the pixel is not dead weight: it actively exfiltrates that data offshore on every mainland visitor, which trips three PIPL wires — a cross-border transfer, automated decision-making by profiling, and a missing separate consent.

The Trade Desk's own privacy policy stating that it may transfer data from the country of origin to the US or other countries, listing IP addresses, unique cookie identifiers, device advertising identifiers and hashed email addresses among the data the platform collects — "We may transfer data from the country of origin to the US or other countries." The Trade Desk's privacy policy also lists IP addresses, cookie and device identifiers, browsing history and hashed email among what the platform collects — the behavioral data the Universal Pixel sends offshore. Source: The Trade Desk — Privacy and the Platform

The Trade Desk in China at a glance

What decides it	In The Trade Desk's own terms — and China's law
What the pixel collects, and that it is personal information	The Trade Desk's privacy policy lists what the platform ingests — "IP addresses," "unique cookie identifiers," "device advertising identifiers," "web browsing history from advertising impressions we see," and "hashed email addresses and other identifying information (or information derived from such)." Tied to an identifiable person in China, every one of those is personal information under PIPL — not "just ad data."
It is sent offshore	The policy states plainly: "We may transfer data from the country of origin to the US or other countries," and its lawful bases cite the EU-U.S. and Swiss-U.S. Data Privacy Frameworks and the APEC Cross Border Privacy Rules System — US, EU and APEC footings, none in mainland China. Shipping a mainland visitor's behavioral data there is a cross-border transfer PIPL governs: notice, a separate consent, and one transfer mechanism (Articles 38–40).
Targeted ads = automated decision-making	A demand-side platform exists to build cross-site profiles and target ads from them — The Trade Desk's own cookie, the TDID, is used to "recognize web-browser profiles over time across sites," and UID2 extends that identity from a hashed email. Profiling to decide which ad to show an individual is automated decision-making under PIPL Article 24: it owes transparency, fairness, and a way to refuse.
Tracking and transfer each need separate consent	Setting non-essential tracking identifiers and sending the data abroad is not covered by a buried "by using this site" line. PIPL requires a lawful basis — for behavioral tracking, consent (Article 13) — and a separate consent before the personal information is provided to another handler and moved across the border (Articles 23 and 39), with an Article 24 right to refuse profiling-based targeting.
Reachability is not the axis	That the pixel resolves and fires from the mainland is the delivery half, not the answer — a reachable offshore pixel simply exports more. The lawful lever is to gate or suppress the offshore pixel for mainland visitors and route any measurement or advertising you still need to Chinese users through a licensed in-country alternative, while the China-facing site itself carries an ICP filing and in-country delivery (State Council Order No. 292; MIIT Order No. 33).

What the pixel actually sends — and where

The Universal Pixel is a snippet you place on your own pages; The Trade Desk serves it from its adsrvr.org ad domain, and once it loads it watches the visitor. The Trade Desk’s privacy policy spells out the catch: the platform collects “IP addresses,” “unique cookie identifiers,” “device advertising identifiers,” “web browsing history from advertising impressions we see,” records of which ads were shown and “where (which web page or app),” and “hashed email addresses and other identifying information (or information derived from such).” The mechanism is exactly what you would expect of an ad platform: “Pixels and cookies, which allow us to recognize web browsers across sites and over time,” anchored to The Trade Desk’s TDID cookie — used, in its own words, to “recognize web-browser profiles over time across sites” — and extended through cookie syncing, where it matches its TDID to partners’ cookie IDs. For a mainland visitor, this is behavioral personal information being gathered in real time.

And it does not stay local. The policy is explicit that “We may transfer data from the country of origin to the US or other countries,” and the transfer framings it relies on — the EU-U.S. and Swiss-U.S. Data Privacy Frameworks and the APEC Cross Border Privacy Rules System — are US, EU and APEC mechanisms; there is no mainland-China region in which this data comes to rest. That is the crucial difference from an ad network that simply fails to load in China: The Trade Desk’s endpoints generally resolve from the mainland, so the pixel is not inert dead weight — it is a live pipe that carries your China visitors’ behavior offshore on every impression, until it is gated.

The UID2 angle sharpens it. Unified ID 2.0, the identity framework The Trade Desk stewards, turns a person’s email into a persistent, deterministic, cross-site identifier: in the project’s own documentation, “An email hash is a Base64-encoded SHA-256 hash of a normalized email address.” Hashing is not anonymization — the same email always yields the same token, so a hashed-email identity is still personal information under PIPL, and it is the connective tissue that lets a profile follow one individual from site to site. Exporting that is not a lower-stakes transfer; it is the most identity-bearing part of the stream.

It’s a cross-border transfer and a profiling mechanism — under PIPL

Three provisions of the Personal Information Protection Law bite the moment a mainland visitor is tracked, and they stack.

First, the cross-border transfer. Sending a China visitor’s identifiers, events and hashed-email identity to The Trade Desk’s offshore servers is a cross-border transfer of personal information under PIPL Articles 38–40: you must give notice, obtain a separate consent for the export, and put one transfer mechanism in place — a CAC security assessment, the CAC standard contract, or certification. Where the volume or sensitivity of what you export crosses the regulators’ thresholds, a CAC-led data-export security assessment can be required before any of it lawfully leaves. If your organization is a critical information infrastructure operator or a high-volume handler, an in-country storage duty also attaches — personal information collected in the mainland must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — the 2025 Cybersecurity Law amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39, substance unchanged. An offshore ad platform structurally cannot meet that duty.

Second, the profiling. A demand-side platform is, by design, an automated-decision engine: it builds cross-site profiles and uses them to decide which ad to serve which person. That is squarely what PIPL Article 24 governs — automated decision-making must be transparent and fair, the individual must be able to refuse, and where you push content or ads based on profiling you must offer an option not to target them. A tracking pixel that feeds a profile is a profiling mechanism, whether or not the data ever left China.

Third, the consent. Setting non-essential tracking identifiers and building behavioral profiles needs a lawful basis, and for this kind of tracking that basis is consent (PIPL Article 13), gathered with real transparency — not a buried “by using this site you agree” line. The cross-border leg needs its own separate consent on top (Articles 23 and 39). The Trade Desk offers no China data-residency region and no “China mode” that resolves any of this; a US- or EU-anchored data-processing posture is not a China one.

Making the offshore pixel reachable is the wrong fix — what actually works

The instinct for most China problems is to make a slow or failing third-party call load faster or more reliably. On this axis that instinct is backwards: making the offshore pixel fire more dependably for mainland visitors does not fix the exposure — it increases it, exporting more behavioral personal information, more consistently, without a lawful basis. You cannot self-host or localize The Trade Desk; it is a third-party ad network, and that is the whole point.

What actually works is governance at the edge. Inventory which ad and tracking pixels fire on your mainland-facing pages and what each one sends offshore. Then gate, suppress or defer the offshore pixel for mainland visitors — serve it only to consented, out-of-scope audiences — and honor the Article 24 right to refuse profiling-based targeting. Where you still need measurement or advertising to reach Chinese users, route it through a lawful, licensed in-country advertising-and-analytics alternative rather than the offshore pixel. The one thing that is not a fix is any arrangement that makes the offshore pixel fire anyway while hiding that it does.

This is a risk map, not a verdict. Whether you owe a separate consent, a transfer mechanism, a data-export assessment, in-country storage, or an ICP filing — and in what combination — turns on your entity, your data volumes, how many of your visitors are in China, and exactly what the pixels on your pages collect. Settle the specifics with counsel before you decide what fires on a single mainland page.

The lawful path — map, localize, deliver

You do not have to abandon The Trade Desk for your other markets to run your China-facing site lawfully. 21YunBox is a compliant overlay, not a migration — and, for the platforms you already run, a partner that sits alongside your stack rather than a competitor to the ad network. There are three moves, and they fit together.

Map. Our China compliance team inventories every ad and tracking pixel that fires on your mainland-facing pages, what behavioral personal information each sends offshore, and where you lack a lawful basis — a separate consent, Article 24 transparency and opt-out, or a transfer mechanism — so the exposure is written down before anything changes.

Localize. Because you cannot localize a third-party ad network, localize here means stopping the unconsented offshore behavioral export and replacing it with a compliant in-country path: gate or suppress the offshore pixel for mainland visitors, honor consent and the right to refuse, and where you still need to reach Chinese users, run measurement and advertising through a licensed in-country alternative. It never means a tunnel that makes the offshore pixel fire anyway. 21YunBox never uses or suggests circumvention of any kind.

Deliver. The China-facing site or app itself is a public internet service that carries an ICP filing duty and needs compliant, in-country delivery — the 21YunBox Optimizer provides it, ICP-filed and in-country, in front of the stack you already run. No rebuild, no second codebase.

The goal is plain: your site runs legally and compliantly for your users in China.

Get a compliance assessment →

Related reading:

Frequently Asked Questions

Is The Trade Desk reachable in mainland China?

Generally, yes — The Trade Desk's ad endpoints resolve and the Universal Pixel fires from the mainland, so it is not a blocked-service question. But reachability is the delivery half, not the answer: because it is reachable, the pixel actively sends your China visitors' behavioral personal information to The Trade Desk's offshore servers on every impression. The compliant move is not to make that offshore pixel load more reliably — it is to gate or suppress it for mainland visitors and use a licensed in-country alternative where you still need to reach Chinese users. Settle the specifics with counsel.

Is the Universal Pixel firing on China visitors a cross-border data transfer?

If it sends their identifiers, events and hashed-email identity to The Trade Desk's offshore servers, yes. The Trade Desk's own policy says it may "transfer data from the country of origin to the US or other countries," and it offers no mainland-China region. Under PIPL that is a cross-border transfer (Articles 38–40): notice, a separate consent, and one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification. A critical information infrastructure operator or high-volume handler also owes the in-country storage duty the Cybersecurity Law's Article 39 (formerly Article 37) sets, and larger or sensitive transfers can require a CAC data-export security assessment. Confirm your exact obligations with counsel.

Does UID2's hashed email make the tracking anonymous or safer?

No. A UID2 is "a Base64-encoded SHA-256 hash of a normalized email address," and because the same email always produces the same token it is deterministic and re-identifiable — personal information under PIPL, not anonymized data. Building a persistent, cross-site identity from someone's email is exactly the profiling PIPL Article 24 governs, and it still needs a consent basis and, for the offshore leg, a separate cross-border consent. If anything, the hashed-email identity is the most identity-bearing part of what the pixel exports, so it raises the stakes rather than lowering them. Settle the specifics with counsel.