Does Back in Stock Work in China? PIPL, Cross-Border Alert Data & the ICP Door

Back in Stock collects your shoppers' emails and phone numbers behind a 'Notify me' button and runs on its vendor's offshore infrastructure — no mainland-China region. For Chinese shoppers that makes the restock alert data a PIPL cross-border transfer, layered on the storefront's own ICP filing duty. A compliance-first look at the two doors.

By the 21YunBox Compliance Team · Reviewed 2026-10-08 · Verified against Back in Stock's own documentation

Does Back in Stock work in China?

Whether you can use Back in Stock for a mainland-China audience is first a data-and-filing question, not a speed one. The app puts a “Notify me” button on sold-out products, collects a shopper's email address or phone number, and alerts them by email, SMS, or push when the item returns — and those contact details, tied to a product interest, are personal information under China's law.

Back in Stock runs inside your Shopify store and on its vendor's offshore infrastructure, with no mainland-China region, so two doors decide it. The public storefront that shows the widget to mainland visitors carries an ICP filing duty; and every email or phone number gathered from a Chinese shopper leaves the mainland — a cross-border transfer PIPL governs, needing notice, a separate consent distinct from the alert opt-in, and a transfer mechanism.

It is not “blocked.” But using it for a mainland audience layers a PIPL consent and data-residency question (the alert data) on the store's own ICP duty — a risk to confirm with counsel.

Compliance snapshot

Not blocked — the “Notify me” widget loads and restock alerts by email, SMS, and push send from the mainland; reachability is not the deciding factor.

The shopper emails and phone numbers it collects are held on the vendor's offshore infrastructure (AWS, WP Engine, Shopify) with no mainland-China region — a PIPL cross-border transfer of personal information.

The “Notify me” form and the alerts are served from that same offshore infrastructure, so each mainland capture crosses the border at the moment of collection.

Collecting and moving a mainland shopper's data needs a PIPL basis (Articles 38–40): notice, a separate consent distinct from the alert opt-in, and a transfer mechanism — CAC security assessment, CAC standard contract, or certification.

The public storefront serving mainland China needs an ICP filing (备案) under State Council Order No. 292 and MIIT Order No. 33 — Shopify provides no mainland-China region for one to attach to.

Get a compliance assessment

No re-platform — keep Back in Stock and your Shopify store

What Back in Stock's own documentation says about China

Fact	Primary source
In the vendor's own words: Amp's privacy policy for Back in Stock states it “may transfer your personal data to countries outside of your country of residence, including outside the United States, the European Economic Area (EEA), and the United Kingdom (UK)” — and offers no mainland-China data location.	Amp privacy policy for Back in Stock, §6 International Transfers (useamp.com), retrieved 2026-10-08
Hosted offshore: Amp names its “hosting and cloud infrastructure providers” as Amazon Web Services, WP Engine, and Shopify — none has a mainland-China region, so shopper alert data gathered in China is held outside the mainland.	Amp privacy policy for Back in Stock, §5 Disclosures to Third Parties (useamp.com), retrieved 2026-10-08
Public sites serving mainland China need an ICP filing (备案). State Council Order No. 292 (Article 4) and MIIT Order No. 33 set the duty; a storefront fully hosted by Shopify has no mainland-China host for a merchant's filing to attach to.	Measures for the Administration of Internet Information Services, State Council Order No. 292, Article 4 (gov.cn), retrieved 2026-10-08
Cross-border personal data is governed by PIPL. Moving a Chinese shopper's email or phone number offshore triggers PIPL Articles 38–40: notice, a separate consent distinct from the alert opt-in, and one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification.	Personal Information Protection Law of the PRC, Articles 38–40 (cac.gov.cn), retrieved 2026-10-08

Sources verified by the 21YunBox compliance team on 2026-10-08.

For a mainland-China audience, the deciding question about Back in Stock is not whether the “Notify me” button paints or how quickly the restock alert goes out — it is whether you are allowed to collect and move the shopper data behind it. Back in Stock is a Shopify App Store app (now operated by Amp, which acquired it in early 2025) that puts a waitlist button on sold-out products, captures a shopper’s email address or phone number, and messages them by email, SMS, or push when the item returns. Those contact details, tied to a specific product interest, are personal information under China’s law — and where they are allowed to live is settled long before performance enters the picture.

Two doors decide this, and neither is about speed. The first is the public storefront that shows the widget to mainland visitors: a public-facing site that carries an ICP filing duty. The second is the alert data itself — Back in Stock runs inside your Shopify store and on its vendor’s own offshore infrastructure, with no mainland-China region, so every email and phone number you gather from a Chinese shopper leaves the mainland. Amp states where that data can travel in its own privacy policy.

Amp's privacy policy for Back in Stock, Section 6 International Transfers, stating it may transfer personal data to countries outside the user's country of residence, including outside the United States, the EEA and the UK, with no mainland-China data location — Amp's own privacy policy for Back in Stock says: “We operate globally and may transfer your personal data to countries outside of your country of residence, including outside the United States, the European Economic Area (EEA), and the United Kingdom (UK).” No mainland-China data location is offered anywhere in it. Source: useamp.com/legal (Privacy Policy, §6 International Transfers)

Back in Stock in China at a glance

What decides it	In the vendor's own words — and China's law
What it is	A Shopify App Store app (now operated by Amp) that adds a "Notify me" button to sold-out products, collects a shopper's email address or phone number, and sends restock alerts by email, SMS, and push. Those contact details tied to a product interest are personal information.
Is it blocked?	No. The widget loads and the alerts send from the mainland. The open question is legality — consent and filing — not reachability.
Serving the public in China	The storefront that displays the widget to mainland visitors is a public-facing site subject to ICP filing (备案) under State Council Order No. 292 (Article 4) and MIIT Order No. 33. Shopify hosts the store with no mainland-China region for a merchant's filing to attach to.
The shopper alert data	Amp says it “may transfer your personal data to countries outside of your country of residence, including outside the United States…”. For a Chinese shopper that is a PIPL cross-border transfer (Articles 38–40): notice, a separate consent, and one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification.
The working design	Keep Back in Stock and your Shopify store exactly as they are; add ICP-filed, in-country delivery as an overlay in front of the storefront. No re-platform, no second app.

What Back in Stock actually is — and what it collects

Back in Stock earns its keep by capturing demand you cannot yet fill. A shopper lands on a sold-out product, taps “Notify me,” and hands over an email address or a mobile number so the store can reach them the moment stock returns — by email, SMS, or browser push. That is the whole value of the app, and it is also the compliance exposure: the asset it creates is a list of identifiable people, each attached to a product they want. Under China’s law that is personal information, not anonymous analytics.

The app is distributed on the Shopify App Store and runs inside your Shopify store, which Shopify hosts entirely — there is no mainland-China region in that arrangement. Amp, the vendor that now operates Back in Stock, processes the collected data on its own offshore infrastructure. So the two things that matter for China are set by architecture, not by configuration: the storefront is a public site served to mainland visitors, and the alert data is held outside the mainland.

Reachable is not the same as compliant

It is tempting to treat “the widget loads in China” as the end of the inquiry. It is only the start. A form that paints and an email that arrives tell you nothing about whether you may lawfully collect a mainland shopper’s phone number, move it offshore, and send a marketing-style message back — or whether the storefront that shows the form carries a filing duty. Those are consent and licensing questions, and they sit upstream of any load-time number.

For that reason we publish no first-party China latency figure for Back in Stock on this page. The decision does not turn on milliseconds; it turns on whether the shopper’s personal information has a lawful basis to leave the country and whether the site serving them is filed. Speed is a real problem for some tools, but it is the wrong axis for this one.

The shopper alert data: a PIPL cross-border story

The email addresses and phone numbers captured by the “Notify me” button are personal information under China’s Personal Information Protection Law. Amp’s privacy policy states that it “may transfer your personal data to countries outside of your country of residence, including outside the United States, the European Economic Area (EEA), and the United Kingdom (UK),” and it names its “hosting and cloud infrastructure providers” as Amazon Web Services, WP Engine, and Shopify — none of which has a mainland-China region. For a shopper in Shanghai or Shenzhen, capturing their contact details and notifying them is therefore a cross-border transfer of personal information from the first keystroke.

PIPL puts that obligation on the handler — you, the merchant, not Amp. Articles 38–40 require you to give notice, obtain a separate consent that is distinct from the shopper’s opt-in to receive the alert, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. Sending SMS to mainland numbers adds a further consent and telecom layer on top. And a critical information infrastructure operator or a large-volume handler faces an in-country storage duty under Article 40 that an offshore app simply cannot satisfy — the same storefront-plus-personal-data pattern we map in our note on e-commerce storefront PIPL compliance. None of this is a verdict; it is a risk to confirm with counsel against what you actually collect and how many Chinese shoppers you serve.

The ICP door: the storefront that serves mainland China

The data question has a sibling that is easy to miss. Any public-facing website served to mainland China from inside the mainland must carry an ICP filing (备案) under State Council Order No. 292 (Article 4) and MIIT Order No. 33. That duty attaches to the storefront, not to the widget — and Back in Stock lives inside a Shopify store that Shopify hosts with no mainland-China region, so there is no in-country host of yours for a filing to attach to.

This is where reachability and legality part company for good. Being able to load the “Notify me” button from Beijing is not the same as being cleared to serve your storefront to a mainland audience. Closing this door means an ICP-filed presence inside the mainland in front of the store your Chinese shoppers actually visit — the groundwork we lay out in our guide to the ICP filing for China.

Where 21YunBox fits — a compliant overlay, not a migration

You keep Back in Stock, and you keep your Shopify store exactly where it runs. We add the one piece a Shopify-hosted app cannot provide: compliant, ICP-filed delivery from inside the mainland, placed in front of the storefront your Chinese shoppers touch — the 21YunBox Optimizer — with no rebuild, no re-platform, and no second restock app. Our China compliance team maps your PIPL cross-border and data-residency exposure against what the “Notify me” button collects and how many mainland shoppers you serve, helps put the separate-consent and transfer-mechanism path in place, and — where the law requires your Chinese shoppers’ data to stay on Chinese soil — stands up compliant in-country delivery and storage alongside it, while your Back in Stock account stays untouched.

Get a compliance assessment →

Related reading:

Frequently Asked Questions

Is Back in Stock blocked in China?

No — the “Notify me” widget loads and restock alerts by email, SMS, and push send from the mainland. But reachability is not the deciding question. Using it for a mainland audience raises a PIPL consent and data-residency question on the shopper alert data, layered on the storefront's own ICP filing duty. Treat that as a risk to confirm with counsel, not legal advice.

Where does the shopper alert data go?

Offshore. Amp's privacy policy says personal data may be transferred to countries outside your country of residence, including outside the US, EEA, and UK, and names its hosting providers as Amazon Web Services, WP Engine, and Shopify — none with a mainland-China region. For a Chinese shopper, capturing an email or phone number and notifying them is a PIPL cross-border transfer needing notice, a separate consent, and a transfer mechanism.

Do I still need an ICP filing?

The public storefront that shows the widget to mainland visitors needs an ICP filing (备案) under State Council Order No. 292 and MIIT Order No. 33. Because the store is fully hosted by Shopify with no mainland-China region, there is no in-country host of yours for a filing to attach to — which is where an ICP-filed, in-country delivery overlay comes in. Confirm your exact obligations with counsel.