Does Trustpilot Work in China? Reviewer Data, PIPL & the Offshore Widget
Trustpilot runs no region inside mainland China — it stores your reviewers' and visitors' personal data with providers in Ireland and the US and loads its TrustBox widget from offshore. For a China audience that is a PIPL cross-border transfer you're responsible for. A compliance-first look at the exposure.
Does Trustpilot work in China?
Trustpilot loads in mainland China — but that is not the question that matters. The reviewer and visitor personal data it collects on your behalf lives on servers in Ireland and the United States, which makes serving China a cross-border transfer under the country's PIPL that you, not Trustpilot, are answerable for.
Trustpilot A/S in Copenhagen is, in its own words, “the entity responsible for processing your personal data,” and what it gathers includes “your name and email address,” your “IP address, browser settings … and location,” and “your review content and star rating.” Its own sub-processor list keeps that data with Amazon Web Services and Google Cloud EMEA Limited in Dublin, Ireland and ClickHouse Inc. in California — with no mainland-China location — and Trustpilot states plainly that “some of these data processors and third-party services will be located in countries outside of the one in which you are based.” For your Chinese users that is a cross-border transfer of personal information PIPL governs (notice, separate consent and a transfer mechanism, Articles 38–43), with an in-country storage duty for CIIOs and large-volume handlers that offshore hosting cannot meet. The table below is Trustpilot's own wording and the rule each line triggers.
This is a risk map, not a verdict — what applies turns on how much personal data you collect through Trustpilot, your role, and who your users are. Our China team can map your exposure with you →
What Trustpilot's own documentation says about China
| Fact | Primary source |
|---|---|
| Trustpilot stores your data in Europe and the US — not mainland China. Trustpilot's own sub-processor list names the providers that hold your data and where they sit: Amazon Web Services and Google Cloud EMEA Limited in Dublin, Ireland, and its data-warehouse provider ClickHouse Inc. in California, USA. No mainland-China location appears anywhere on the list, so personal data you gather from Chinese users through Trustpilot is held offshore by design — the starting point of any PIPL cross-border analysis. | Trustpilot — Sub-processors (corporate.trustpilot.com), retrieved 2026-10-07 |
| Trustpilot collects identifiable personal data from your Chinese reviewers and visitors. In its end-user privacy terms, Trustpilot A/S — a Copenhagen company — calls itself “the entity responsible for processing your personal data,” and sets out what it gathers: “your name and email address,” your “IP address, browser settings … and location,” how you “interacted with our platform,” and “your review content and star rating.” That is personal information of people in China, captured the moment a Trustpilot review form or TrustBox runs on your site. | Trustpilot — End-user Privacy Terms (legal.trustpilot.com), retrieved 2026-10-07 |
| Routing that data offshore is a regulated cross-border transfer — and you are the handler. Trustpilot itself notes that “some of these data processors and third-party services will be located in countries outside of the one in which you are based,” and that it clears European transfers only through an approved mechanism. China runs the same logic in reverse: moving your users' personal information out of the mainland is a cross-border transfer under PIPL requiring notice, separate consent and a transfer mechanism (Articles 38–43), and for a CIIO or large-volume handler the data must stay in China (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). Trustpilot is your processor — the PIPL duties land on you, not on it. | Trustpilot — End-user Privacy Terms (legal.trustpilot.com), retrieved 2026-10-07; PIPL Articles 38–43 & 40; Cybersecurity Law Article 39 (formerly Article 37) |
| The review widget is delivered from offshore, so it can drag or fail in China. Trustpilot shows your reviews through a TrustBox: it “generates the code” and you “copy and paste the TrustBox HTML into the BODY of your site.” That snippet loads its script and review content from Trustpilot's own domain — the same offshore infrastructure above, with no mainland point of presence. An offshore third-party widget reached from inside China can load slowly or fail to resolve, and a review box that stalls holds up the part of the page it sits in. This is the delivery half of the question; the legal half is what decides whether you may collect the data at all. | Trustpilot — TrustBox widgets (business.trustpilot.com), retrieved 2026-10-07 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, Trustpilot raises a data question long before a speed one. It is a review platform that collects personal information from the people who read and write reviews on your site — names, email addresses, IP and behavioral data, and the review text itself — and keeps all of it on infrastructure outside China. It then paints those reviews onto your pages through an embeddable widget loaded from its own offshore domain. The reviews may well appear for your Chinese visitors; the exposure is that the personal data behind them crosses the border under China’s privacy law, and the widget that renders them has no footing inside the mainland.
Trustpilot in China at a glance
| What decides it | In Trustpilot's own terms |
|---|---|
| Where your data lives | Trustpilot's sub-processor list names Amazon Web Services and Google Cloud EMEA Limited in Dublin, Ireland, and ClickHouse Inc. in California, USA. No mainland-China location appears; Trustpilot A/S itself is in Copenhagen. |
| Who collects it, and what | Trustpilot calls itself “the entity responsible for processing your personal data” and gathers “your name and email address,” your “IP address, browser settings … and location,” and “your review content and star rating.” |
| Crossing the border | Trustpilot: “some of these data processors and third-party services will be located in countries outside of the one in which you are based.” For Chinese users that is a PIPL cross-border transfer — and the handler is you, not Trustpilot. |
| In-country storage | With no mainland region, a CIIO or large-volume handler's residency duty (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) cannot be satisfied on Trustpilot. |
| How the widget is delivered | Reviews render through a TrustBox you “copy and paste … into the BODY of your site,” loaded from Trustpilot's offshore domain — reachable, but liable to stall or fail from inside China. |
Where your reviewers’ data actually lives
Trustpilot does not run on infrastructure you control, and none of it sits in mainland China. On its own sub-processor list, the providers that store and process your data are Amazon Web Services and Google Cloud EMEA Limited in Dublin, Ireland, with its data-warehouse provider ClickHouse Inc. in California, USA. Trustpilot A/S itself is a Copenhagen company. So every name on the list that touches personal data is in the EU or the US, and there is no mainland-China location to put any of it inside the country. That settles the residency question before anything about page speed comes up: the data your Chinese reviewers and visitors hand to Trustpilot is stored offshore by design.
Your Chinese users’ data crosses the border — and you carry the duty
Trustpilot is explicit about collecting identifiable information from the people who use it. In its end-user privacy terms it describes itself as “the entity responsible for processing your personal data” and lists what that data is — “your name and email address,” your “IP address, browser settings … and location,” a record of how you “interacted with our platform,” and “your review content and star rating.” When those people are in mainland China, moving that information to Ireland or the United States is a cross-border transfer under the Personal Information Protection Law: the handler must give notice, obtain separate consent, and clear one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification (Articles 38–43). For a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)), which offshore hosting cannot do. And the handler holding these duties is you: Trustpilot is your processor, acting on the data you route to it. Trustpilot frames the same principle for its own transfers, noting that “some of these data processors and third-party services will be located in countries outside of the one in which you are based.”
The review widget is served from offshore
Trustpilot’s reviews reach your visitors through a TrustBox: Trustpilot “generates the code” and you “copy and paste the TrustBox HTML into the BODY of your site.” That snippet pulls a loader and the review content from Trustpilot’s own domain, served from the same offshore infrastructure as everything above, with no point of presence inside the mainland. The review box is not blocked, but an offshore third-party widget reached from inside China can load slowly or fail to resolve, and a TrustBox that stalls holds up the slice of the page it sits in. Separately — and this is a question for counsel, not one to overstate — public, user-generated reviews shown to a mainland audience can touch China’s content rules, which is another reason to treat a China-facing review display as a compliance decision rather than a drop-in snippet.
This is a risk map, not a verdict: how much of this bites depends on how much personal data you collect through Trustpilot, whether you count as a CIIO or large-volume handler, and who your users are — worth settling with counsel before you ship it to China.
Where 21YunBox fits — a compliant overlay, not a migration
You keep Trustpilot exactly where it is. What we add is the piece a Copenhagen review platform with no mainland footprint cannot: compliant, ICP-filed delivery from inside the mainland, placed in front of your existing site and its origin — no rebuild, no second codebase, and no move off Trustpilot. Our China team maps what personal information you actually collect through Trustpilot, weighs your PIPL cross-border and data-residency exposure against your entity and data volumes, and stands up the in-country delivery and lawful data handling a China presence needs, while your reviews keep coming from Trustpilot and your application stays put.
Related reading:
