Does Yotpo Work in China? Customer Data, PIPL & Where It's Stored
Yotpo stores your customers' reviews, loyalty and SMS data in a US data center on AWS, with no mainland-China region — so serving Chinese shoppers ships their personal data offshore under PIPL, and its widgets load from an offshore CDN. A compliance-first look at the data-residency door.
Does Yotpo work in China?
Yotpo's widgets may paint on your storefront, but that was never the compliance question. Yotpo's whole job is collecting and acting on customer personal data — names, emails, phone numbers for SMS, purchase history and reviews — and it stores that data in a United States data center, which Yotpo states in its own privacy guide. For your Chinese shoppers the exposure isn't whether it loads; it's that their personal information is being held offshore.
Yotpo's privacy guide says plainly, "Our data center is located in northern Virginia in the United States and is hosted with Amazon Web Services (AWS)," and its sub-processor list places cloud storage in the USA and its CDN in Israel and the USA — with no mainland-China region anywhere. So the personal information Yotpo collects from your mainland customers is a cross-border transfer PIPL governs — notice, separate consent and a transfer mechanism — and the handler is you, the merchant, not Yotpo. That same offshore footprint is why the review and loyalty widgets, fetched from outside the mainland, can load late or fail. The table below is Yotpo's own wording and the rule each line triggers.
This is a risk map, not a verdict — whether a data-localization duty or China's SMS-consent rules also apply turns on your role, your data volumes and how you message. Our China team can map your Yotpo exposure with you →
What Yotpo's own documentation says about China
| Fact | Primary source |
|---|---|
| Yotpo stores your customers' data in a United States data center — in its own words. Yotpo's privacy guide states: "Our data center is located in northern Virginia in the United States and is hosted with Amazon Web Services (AWS)." That is offshore from the mainland, and Yotpo publishes no mainland-China region — so the personal information it collects from your Chinese shoppers is held outside China, a cross-border transfer under PIPL. | Yotpo Privacy Guide (yotpo.com/yotpo-privacy-guide), retrieved 2026-10-07 |
| Yotpo's own sub-processor list keeps both storage and delivery offshore. Yotpo names "Amazon Web Services, Inc." as its "Cloud computing / storage provider" in the "USA," and its content-delivery sub-processors are "Akamai Technologies Israel Ltd." (Israel) and "Edgecast Inc." (USA). None of the sub-processors Yotpo lists sits in mainland China — so the data at rest and the widgets your shoppers load are all served from outside the mainland, a cross-border transfer under PIPL. | Yotpo Subsidiaries and Sub-Processors (yotpo.com/subprocessors), retrieved 2026-10-07 |
| Everything Yotpo holds is personal information, so moving it is a transfer PIPL governs. Reviews, loyalty profiles, email addresses, order history and — for its SMS product — customers' phone numbers all name and profile individuals, not anonymous metrics. Collected from mainland users and stored offshore, that is a cross-border transfer under PIPL (notice, separate consent and a transfer mechanism, Articles 38–43); for a CIIO or large-volume handler, China-collected personal information must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). Yotpo's own guide notes that if you use its SMS service it shares "your customers' personal data" with further partners — and SMS marketing to Chinese numbers also engages China's own messaging-consent rules, a point to confirm with counsel. | Yotpo Privacy Guide (yotpo.com/yotpo-privacy-guide), retrieved 2026-10-07; PIPL Articles 38–43 & 40; Cybersecurity Law Article 39 (formerly Article 37) |
| The widgets load from offshore, and ICP is your storefront's door — not Yotpo's. Yotpo says it "makes use of Dynamic CDN's solution," which it credits with improving "delivery performance in terms of response time in different geographical regions" — an offshore delivery network, so on a China-facing storefront the review and loyalty widgets can load late or fail. But reachability isn't the legal gap. The ICP filing a public mainland site needs (State Council Order No. 292; MIIT Order No. 33) attaches to your storefront, not to the Yotpo app — so don't let an ICP checkbox hide the real exposure, which is where the customer data lives. | Yotpo System Architecture and Security (support.yotpo.com), retrieved 2026-10-07; State Council Order No. 292; MIIT Order No. 33 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the question that matters about Yotpo is not whether a star rating paints under your products — it is where the customer data behind those reviews, loyalty points and SMS campaigns is allowed to live. Yotpo answers that in its own privacy guide: the personal information it holds for you sits in a data center in the United States, on Amazon Web Services, with no region inside mainland China. Running Yotpo for Chinese shoppers therefore carries their names, emails, phone numbers and purchase history across the border, into a jurisdiction China’s law treats as foreign — and because the widgets are served from that same offshore footprint, they can load late or fail as well. Reachability is the easy half; where the data is held is the half that decides whether you may use it as it stands.
Yotpo in China at a glance
| What decides it | In Yotpo's own terms |
|---|---|
| Where your data lives | Yotpo's privacy guide: “Our data center is located in northern Virginia in the United States and is hosted with Amazon Web Services (AWS).” Its sub-processor list adds cloud storage in the USA and CDN nodes in Israel and the USA. No region sits inside mainland China. |
| What it collects | Across reviews, loyalty and SMS: shopper names, email addresses, phone numbers, order history and the photos and text submitted in reviews — personal information, not anonymous metrics. |
| Crossing the border | Running Yotpo for mainland customers moves that personal information offshore — a cross-border transfer PIPL governs, with notice, separate consent and a transfer mechanism (Articles 38–43). The handler is you, the merchant, not Yotpo. |
| SMS to Chinese numbers | Marketing texts to mainland phone numbers also engage China's own messaging-consent rules — a separate exposure worth confirming with counsel, not assuming away. |
| Widgets & ICP | The review and loyalty widgets load from an offshore CDN, so they can be slow or fail; ICP attaches to your storefront, not to Yotpo. Loading is the easy half — lawful handling is the half that decides it. |
Yotpo keeps your customer data in the United States — and says so
Yotpo does not hold your program’s data in mainland China, and it is direct about where it does. Its privacy guide states that “Our data center is located in northern Virginia in the United States and is hosted with Amazon Web Services (AWS),” and its published sub-processor list names “Amazon Web Services, Inc.” as the “Cloud computing / storage provider” in the “USA,” with content delivery handled by “Akamai Technologies Israel Ltd.” in Israel and “Edgecast Inc.” in the USA. Not one of the sub-processors Yotpo lists sits in mainland China.
That geography settles the question before performance enters it. The handler of your Chinese shoppers’ personal information is you, not Yotpo; when Yotpo stores that information in Virginia on your behalf, you are the party sending it abroad. “Our reviews already show up” does not close the matter, because reaching a shopper and lawfully holding that shopper’s data are two different tests — and only the second turns on where Yotpo’s servers sit.
Reviews, loyalty and SMS are all personal information — so moving it is a PIPL transfer
A reviews-and-loyalty platform is built from exactly the data China’s law protects. The names, email addresses, phone numbers, order histories and review content Yotpo collects name and profile individual people — personal information under China’s Personal Information Protection Law, not anonymous telemetry. Points balances, VIP tiers and campaign lists are layered on top of those identifiers.
Because that information is gathered from mainland users and stored offshore, PIPL treats the flow as a cross-border transfer: the handler must give notice, obtain separate consent, and clear one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification (Articles 38–43). If you are a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty a service running only in the United States has no way to meet.
Yotpo’s SMS product sharpens the point. Its own guide notes that if you use its SMS service it shares “your customers’ personal data” with further partners, and marketing texts sent to mainland phone numbers engage China’s own rules on messaging and consent alongside PIPL. Treat that as an added exposure to confirm with counsel — not a settled yes or no.
The widgets load from offshore — and ICP isn’t Yotpo’s door
Yotpo is reachable from China, but its on-store widgets are fetched from outside the mainland. Yotpo says it “makes use of Dynamic CDN’s solution,” which it credits with improving “delivery performance in terms of response time in different geographical regions” — an offshore delivery network, so on a China-facing storefront the review and loyalty widgets can load late or only partially. A widget that eventually paints is still a widget whose data lives in another country; loading is not the same as lawful.
It is just as important not to invent a door that isn’t there. Yotpo runs as an app inside your storefront, so the ICP filing a public-facing mainland site requires (State Council Order No. 292; MIIT Order No. 33) belongs to that storefront layer, not to the Yotpo app — Yotpo does not need its own ICP, and treating it as if it did would aim the assessment at the wrong risk. On Yotpo the live questions are narrow and two: where the customer data is collected and stored, and whether the widgets reach your shoppers at all.
This is a risk map, not a verdict — whether you owe a cross-border mechanism, in-country storage, SMS-consent handling, or some combination depends on what you collect, how much of it you hold, how you message and who your users are, and it is worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
Yotpo stays on your storefront exactly as it runs today — reviews, loyalty and SMS keep working, and you move nothing. What we add is the piece an offshore marketing platform cannot supply on its own: ICP-filed delivery from inside the mainland, set in front of your existing origin, with no rebuild and no second codebase to carry. Our China team works through your PIPL cross-border and data-residency position — and the added SMS-consent question if you text Chinese numbers — for your entity, your data volumes and your users, then stands up the in-country delivery and lawful data handling a compliant mainland presence calls for, while your storefront and Yotpo stay precisely where they already are.
Related reading:
