Does Drip Work in China? PIPL, Cross-Border Data & the ICP Door
Drip is a U.S. marketing-automation platform that stores your subscribers' and shoppers' personal and behavioral data offshore, with no mainland-China region — so the China question is a PIPL cross-border-transfer one, while the ICP filing sits on the store that embeds Drip's script. A compliance-first look.
Does Drip work in China?
Reachability is the easy part. Drip is a U.S. marketing-automation platform that stores your subscribers' and shoppers' personal and behavioral data offshore, so the mainland-China question is a data-transfer one — and it can bind even when every pop-up loads perfectly.
In its own privacy policy, "Drip Global, Inc." is "the data controller of the personal information we hold about you," data that "may be transferred to and stored in countries outside of the jurisdiction you are in"; Drip is certified under the EU-U.S. Data Privacy Framework and "subject to the investigatory and enforcement authority of the United States Federal Trade Commission." For a store selling into China that means the subscriber lists, browsing and cart events Drip collects leave the mainland — a cross-border transfer PIPL governs — while the ICP filing stays on the store that embeds Drip's snippet, not on Drip. The table below is Drip's own wording and the rule each line triggers.
This is a risk map, not a verdict — what you owe turns on your entity, your data volumes and who your shoppers are. Our China team can map your exposure with you →
What Drip's own documentation says about China
| Fact | Primary source |
|---|---|
| Drip is a U.S. company that stores your data offshore. In its own privacy policy, "Drip Global, Inc." is "the data controller of the personal information we hold about you," and the data it collects is "stored on secure servers" that "may be transferred to and stored in countries outside of the jurisdiction you are in." Drip is certified under the EU-U.S. Data Privacy Framework and "subject to the investigatory and enforcement authority of the United States Federal Trade Commission" — so your records land in the United States, not the mainland. | Drip — Privacy Policy (drip.com/privacy), retrieved 2026-10-07 |
| The data Drip holds is exactly what China's law guards. Drip says it processes, through your store, "individuals that are subscribers, website visitors or customers of our customers (which we call 'Customer Data')," plus the browsing and ecommerce events its automations run on. Collected from shoppers in mainland China and stored offshore, that is a cross-border transfer of personal information under PIPL — notice, separate consent and a transfer mechanism (Articles 38–43) — and for a CIIO or large-volume handler it must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). | Drip — Privacy Policy (drip.com/privacy), retrieved 2026-10-07; PIPL Articles 38–43 & 40; Cybersecurity Law Article 39 (formerly Article 37) |
Drip is an embedded layer on your store, so the ICP filing sits on the store — not on Drip. Drip's setup docs state "Your JavaScript snippet is the direct link between your Drip account and your website," pasted "right before the closing </body> tag," and its forms are "pop-ups and other conversion pages." The public site that embeds them is what a mainland audience reaches, so the ICP filing (State Council Order No. 292; MIIT Order No. 33) attaches to that store's mainland hosting. Drip adds an offshore-loaded layer on top; it is not itself an ICP-fileable host. | Drip Help Center — Install Your JavaScript Snippet (help.drip.com), retrieved 2026-10-07; State Council Order No. 292; MIIT Order No. 33 |
| The tracking layer itself loads from offshore. Drip collects on-site behavior through "tracking technologies, including cookies, Flash objects, web beacons, embedded scripts," and that snippet is served from Drip's own offshore service, not from inside the mainland. Whether it and your pop-ups render reliably for a shopper in China is therefore a qualitative reachability question — the delivery half, distinct from the PIPL and ICP half that decides whether you may run the setup at all. (We publish no latency figure for this page.) | Drip — Privacy Policy (drip.com/privacy), retrieved 2026-10-07 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a store selling into mainland China, the question about Drip is not whether its pop-ups paint quickly — it is whose law governs the shopper data Drip collects, and where that data is allowed to live. Drip answers the first part in its own privacy policy: it is a U.S. company that stores the personal information it holds on offshore servers. That makes a China-facing Drip setup a data-transfer question first and a delivery question second. Drip’s tracking snippet and sign-up forms ride on your own store, so the ICP filing stays with that store, not with Drip — while every subscriber record and cart event Drip gathers from your Chinese shoppers leaves the mainland. The reach is rarely the exposure; the data path and the licensing are.
Drip in China at a glance
| What decides it | In Drip's own terms |
|---|---|
| Who holds the data | “Drip Global, Inc.” is “the data controller of the personal information we hold about you,” a U.S. company that stores the data it collects “on secure servers” which “may be transferred to and stored in countries outside of the jurisdiction you are in.” No region sits inside mainland China. |
| What it collects | Through your store, Drip processes “individuals that are subscribers, website visitors or customers of our customers (which we call ‘Customer Data’)” — subscriber contact details plus behavioral and ecommerce events. |
| Where that data goes | Drip is certified under the EU-U.S. Data Privacy Framework and “subject to the investigatory and enforcement authority of the United States Federal Trade Commission.” Collected from mainland shoppers, that personal information leaves China — a cross-border transfer PIPL governs. |
| How it attaches to your site | “Your JavaScript snippet is the direct link between your Drip account and your website,” pasted “right before the closing </body> tag,” and its forms are “pop-ups and other conversion pages.” Drip is an embedded layer on your store, not a host. |
| Serving the public | The store that embeds Drip's snippet is the public site mainland visitors reach, so the ICP filing attaches to that store's mainland hosting — not to Drip. Drip's offshore-loaded script and forms add a reachability question on top. |
A U.S. platform that keeps your shopper data offshore
Drip is explicit about who holds your data and where. In its privacy policy, “Drip Global, Inc.” is “the data controller of the personal information we hold about you,” and the personal information it collects is “stored on secure servers” that “may be transferred to and stored in countries outside of the jurisdiction you are in, where we and our third party service providers have operations.” Drip is certified under the EU-U.S. Data Privacy Framework and is “subject to the investigatory and enforcement authority of the United States Federal Trade Commission,” committing to handle complaints about “personal information transferred to the United States.” None of that infrastructure sits inside mainland China. So before performance enters the picture, a China-facing Drip setup places your shoppers’ data under U.S. jurisdiction and outside the mainland — which is where the compliance question starts.
Subscriber lists and cart activity are exactly what the law guards
The data Drip keeps is not incidental metadata — it is the shopper’s identity and behavior. Drip says it processes, through your store, “individuals that are subscribers, website visitors or customers of our customers (which we call ‘Customer Data’),” alongside the browsing, email-engagement and ecommerce events its automations run on. When those individuals are in mainland China and that data is stored offshore, you have a cross-border transfer of personal information under PIPL: as the handler, you owe affected shoppers notice and separate consent, and you must clear one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification (Articles 38–43). If you are a critical information infrastructure operator or move personal information above the regulated volumes, that data has to be stored in the mainland in the first place (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty Drip’s offshore servers cannot satisfy.
The ICP question lives on your store, not on Drip
Drip does not host your website, so it is not the thing an ICP filing attaches to. Drip installs as code on a site you already run: “Your JavaScript snippet is the direct link between your Drip account and your website,” and “Every Drip account comes with its own unique snippet that you can copy and paste onto your website,” dropped “right before the closing </body> tag.” Its forms are “pop-ups and other conversion pages” embedded in your pages. Whatever public site serves those pages to a mainland audience is what needs an ICP filing — ICP 备案 under State Council Order No. 292 and MIIT Order No. 33 — tied to a hosting resource inside the mainland. That obligation stays with your store; Drip simply adds an offshore-loaded layer on top of it. “We use Drip” neither creates nor satisfies the filing.
Reachable or not, the script and forms load from offshore
Because Drip’s snippet and pop-ups are fetched from Drip’s own offshore service rather than from inside China, whether they render reliably for a mainland shopper is a separate, delivery-side question. We publish no measurement on this page, and we are not claiming Drip is blocked; the honest point is narrower. An embedded marketing layer that loads from outside the mainland is a reachability consideration — a form that fails to appear is a lost signup, not a legal breach — and it sits apart from the PIPL and ICP questions that decide whether you may run the setup at all. Delivery is the supporting half; the data path and the licensing are the spine.
This is a risk map, not a verdict: whether you owe PIPL consent and a transfer mechanism, in-country storage, an ICP filing on your store, or all of these turns on your entity, how much personal data you hold and who your shoppers are — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep running Drip exactly as you do now. What we add is the piece an embedded, offshore marketing layer cannot give you on its own: compliant, ICP-filed delivery from inside the mainland, set in front of your existing store origin — no rebuild, no second codebase, and no move off Drip. Our China compliance team maps your PIPL cross-border and data-residency exposure for the subscriber and behavioral data Drip collects, confirms where the ICP filing on your store has to sit, and stands up the in-country delivery and storage a lawful China presence needs, while your Drip automations keep firing from the stack you already trust.
Related reading:
