How to Use Banned US Models in China
Markets in Everything: Taobao Edition
I did a podcast with Doug, Dylan and Jon updating our AI Mandate of Heaven tier list and talking about how America needs science research and immigrants (Apple Podcasts, Spotify). If you’re an AI researcher interested in signing onto a short letter in support of the NSF and global STEM talent coming to America, please respond to this email!
Zilan Qian is a fellow at the Oxford China Policy Lab and an MSc student at the Oxford Internet Institute.
In China, U.S.-based large language models like ChatGPT, Claude, or Gemini are technically banned, blocked, or buried under layers of censorship. The Chinese government has only explicitly banned ChatGPT, citing concerns over political content, while other U.S. models like Claude and Gemini are not formally banned but remain inaccessible due to the Great Firewall. U.S. LLM providers also restrict access from China but leave some loopholes: OpenAI blocks API use but Azure continues to serve enterprise clients via offshore data centers; Anthropic blocks access to Claude within China but permits use by Chinese subsidiaries based in supported regions abroad; and Google does not offer the Gemini API in China, but access seems to be still possible via third-parties like Cloudflare (we reached out to Google for a comment but didn’t hear back).
But on Taobao, the country’s largest e-commerce platform, consumers and companies can buy access to these models with just a few clicks. This piece explains how Western models are priced, advertised, bought, and sold in China, and what their popularity reveals about state censorship, platform enforcement, and consumer demand.
Market Overview
How Do Chinese Sellers Price a banned LLM?
Sellers use a range of strategies to appeal to consumers with different priorities — cost, convenience, privacy, and technical needs. Pricing largely depends on the type of access offered — i.e., shared accounts (lower-cost, multi-user access) versus private accounts (higher-cost, single-user access). How users connect to the models also changes the marketing approach. VPN-free access is often marketed with phrases like “domestic direct connection (国内直登)” or “no magic [VPN] needed (无需魔法),” typically referring to proxy sites that offer a simplified, browser-based experience. Other factors influencing price include the model’s subscription tier ( for example, ChatGPT o3 vs. o1), connection stability, and subscription time. Most “domestic connection” or “transferred API” (API purchased through third parties) options are priced significantly below the rates charged by official providers like OpenAI or Anthropic.
For example, the screenshot below shows 27 different Claude pricings, with prices differing based on:
Subscription time: 1–60 days
Website access: an account for proxy sites versusan official Anthropic Claude account (with VPN service included)
Subscription tier: Claude 3.7 Sonnet versus Claude Pro
API access: “中转 API” (Transfer API) versus “官方API” (API purchased from official anthropic platform)
Compatibility with SillyTavern, a popular third-party frontend interface (called “酒馆” in Chinese), which enhances user interaction with LLMs.
While an official Claude Pro account costs 199 RMB (27 USD) per month, which is more expensive than Anthropic’s rate at 20 USD, a “direct connection” Claude Pro account from a mirror site is only 65 RMB (9 USD) per month.
Transferred API usually comes from established transfer stations (中转站) for API, usually at a 70-90% discount compared to official prices (e.g., selling 1 USD worth of tokens for 1 RMB). The low prices are made possible by utilizing one or more of the following tactics:
Exploiting free API quotas by bulk-registering developer accounts (e.g., Anthropic’s $5 free API);
Reselling unused portions of other people’s API quotas;
Traffic optimization techniques, such as request aggregation: combining multiple users’ queries into a single batch call to the LLM API to reduce costs
Leveraging corporate or educational discounts.
How do Chinese sellers advertise access to U.S. LLMs?
While these tactics help vendors reach potential buyers, they also reveal a surprisingly open market landscape, which raises the question: Who is actually buying and selling these models? Sellers typically advertise and communicate their services using product images that include large brand logos, stylish fonts, and keywords highlighting their service strengths. Direct keyword searches work for most models, like Claude or Gemini. Many listings include the names of specific models directly in their product titles, often alongside a dense string of keywords like “API,” “domestic direct connection,” “official account,” or “exclusive” to boost visibility. The fact that such listings remain easy to find suggests a lax approach to censorship, especially given that many of these terms are potentially sensitive.
The censorship drastically increases when it comes to ChatGPT, which is likely due to the state’s explicit crackdown on this model family, which began in 2023. When selling ChatGPT the model, one mechanism is to market the subscription as a book. As of March 2025, you could still buy “ChatGPT Book: How to Make Money Online with ChatGPT,” “What is GPT Doing…and Why Does It Work,” and “ChatGPT for Beginners — New Book Original English Version,” but end up buying ChatGPT, the AI model. These products were often set at irrationally low prices, usually 1-10 RMB, or 0.1-1.4 USD, to signal that they are not selling a book or the product itself, or rather the initial purchase it just to signal interest. Some also added “2025 new version” or changed “What is GPT Doing” to “What is GPT-4 Doing” make it more obvious. Based on customer feedback, customers pay these low prices as symbolic transactions on the platform and then contact the seller through chat to complete the purchase. The “book sellers” usually displayed large OpenAI and “ChatGPT" graphics in their images and product descriptions.
As of late April, the keyword censorship has caught up and this mechanism is no longer viable. Now, in order to find ChatGPT sellers, you will need to search directly, and only include the version names in your search(i.e., o1, o3, 4.5). The product photos no longer have any indicated association with ChatGPT. No text in the photo mentions “openai” or “chatgpt”, but you do occasionally see the word “奥特曼”, a transliteration of (Sam) “Altman” as well as “Ultraman,” the Japanese TV series. Thanks to “Ultraman,” “Altman” is still uncensored. Interestingly, one seller of o1-pro and o3-mini puts “用AI服务国人” (using AI to serve our compatriots) in their photo, potentially as a fun pun or a patriotic slogan to evade censorship.
Listings involving ChatGPT are often heavily disguised — using transliterations, vague product names, or only having one symbolic price. In many cases, buyers must contact the seller directly to obtain actual pricing details. Note that because keyword censorship and evasion is a rapidly evolving game, the mechanism only applies as of April 2025.
The price lists for a seller selling ChatGPT and other AI products. “4欧普拉斯” reads like “4o+” in Chinese; g开头mask (“g-beginning mask”) refers to Musk’s Grok.
The Diversity of the Buyer and Seller Ecosystem
Among all uncensored models (Gemini, Perplexity, Copilot, Claude, Mistral AI), Claude is the most popular one. The most popular seller has 50k+ transactions with 7k repeated purchases. Based on the review section, many buyers are information technology (IT) or computer science (CS) students who may be attracted to Claude's advanced coding ability, with some sharing how Claude helps them to get into PhD programs or pass their CS classes. Gemini is also popular, allowing buyers to leverage its multimodal capabilities to generate images.
Many of the sellers are seasoned Taobao “账号代充” agents — veterans in the business of topping up game accounts, unlocking premium services at a discount, or helping users bypass regional restrictions. In the past, these agents undercut official prices for Apple games by exploiting refund loopholes or using currency arbitrage with international gift cards. Now, some have turned to the U.S.-based large language models, using the same strategies in addition to building proxy sites, purchasing API through an API transfer station, or disguising domestic models as U.S. LLMs.
Some stores on Taobao are small and low-traffic, listing only one or two LLMs with minimal engagement. But others are well-established vendors with strong reputations, thousands of followers, and over 30,000 repeat purchases. These top sellers often offer a broader portfolio, bundling U.S.-based LLMs with popular AI tools like Pika, Suno, and Midjourney, as well as non-AI software such as Zoom and Overleaf Pro. While many stores seem new to the market, a few have deep roots on the platform. One vendor, active for 14 years, sells Norton 360 antivirus software alongside Gemini and Perplexity. Another, active for seven years, offers only Claude — but does so through product listings disguised as jewelry items, with categories labeled like “rings” and “necklaces.”
Why the Market Survives
The variety and scale of sellers suggest that this market is no small anomaly. So how has it managed to persist, relatively undisturbed, under one of the world’s most tightly-controlled internet regimes?
The State Doesn’t Really Care
The market shows that China's ban is selectively enforced and mainly focuses on ChatGPT rather than all US models. Despite its reputation for having one of the world's most extensive censorship regimes, China’s internet control enforcement is often decentralized, with local authorities and platforms playing major roles. Censorship efforts also tend to prioritize preventing collective action over restricting general information.
LLMs likely do not trigger existential concerns for the state, as they do not inherently expose users to sensitive political content or facilitate mass mobilization in a way that U.S. social media platforms might. Although state media highlights ChatGPT’s alleged spread of “misinformation” about Xinjiang, Taiwan, and the Diaoyu Islands as justification for the ban in 2023, a chatbot’s output depends on user input, which poses a lower perceived threat. The state also may not have enough momentum to strictly enforce bans on all U.S. models after cracking down on ChatGPT symbolically.
However, the existence of a market for US LLMs should not be mistaken for a relaxation of controls. VPN use remains tightly regulated, and the popularity of mirror sites and API proxies reflects efforts to sidestep VPN risks. Buyers frequently emphasize concerns over “stability” and “safety” in their reviews, underscoring that censorship continues to shape this grey market in subtle but persistent ways.
The Platform: New Wine in an Old Bottle (旧瓶装新酒)
Even if the central government doesn’t treat foreign LLMs as an existential threat, what about the platforms themselves? Do companies like Taobao take active steps to self-police? Unlikely. For Taobao, the market for US LLMs is simply “new wine in old bottles”. Even when it comes to far more serious issues — such as the sale of unlicensed drugs or firearms — enforcement on Taobao has historically been patchy at best. Over a decade ago, shady sellers evaded platform controls by tweaking keywords or relying on vague euphemisms to sell guns and drugs. Over the past few years, various random illicit products have slipped through the cracks on Taobao: oversea books and magazines, unofficial “Squid Game” merchandise, and even Ivy League email addresses. The censors played the usual cat-and-mouse game, with Taobao censoring direct keyword searches and related euphemisms, but sellers always found ways to get around.
If Taobao were serious about cracking down on illicit goods, the keyword evasion tactics used by ChatGPT vendors over the years would not be so common. But the platform has little incentive to act aggressively against these sellers unless pushed by the authorities. After all, compared to drugs and weapons, offering access to ChatGPT is relatively harmless.
The Public: the AI hype and the DeepSeek problem
If the state isn't cracking down aggressively and the platform isn’t motivated to act, then the question shifts to the consumer: Why are Chinese users still so eager to pay for U.S. models, especially with powerful domestic alternatives like DeepSeek now widely available?
First, the current market for AI tools in China predates the DeepSeek boom. Long before DeepSeek arrived, the Chinese public had already developed a complicated love-hate relationship with AI. A 2024 study analyzing large-scale Weibo posts found widespread discussion of ChatGPT, often centered on fears of job displacement. These anxieties, amplified by the country’s ongoing unemployment crisis, were seized upon by opportunistic influencers who pushed the idea that people must “master AI or be replaced by it.” Li Yizhou, a serial entrepreneur turned self-styled startup mentor with no AI background, began posting extensively about the technology following ChatGPT’s release in late 2022. His online course on AI raked in over $6.8 million in revenue in 2023 alone, indicating a huge demand for AI in China before much of the rest of the world was talking about it.
Now that DeepSeek is publicly accessible, everyday users still face two major barriers: system overload and excessive censorship. “Server busy” messages have become a frequent frustration, as the model struggles to handle surging traffic after gaining popularity among mainstream users. Technical limitations, including U.S. export controls on advanced chips, further constrain DeepSeek’s computing power. Additionally, user habits formed before DeepSeek’s release have created a certain stickiness to U.S. models. “People who are used to ChatGPT cannot tolerate DeepSeek’s frequent unavailability,” wrote Gui Xingren (硅星人), a popular Chinese tech blog that closely follows the domestic AI scene.
Meanwhile, DeepSeek’s aggressive content moderation poses another challenge. For example, the system refuses any query containing the term “CCP,” even benign ones like “list the economic experts in the CCP.” On RedNote, many users share the frustration of DeepSeek being overly sensitive — many have no clue why DeepSeek would refuse certain topics, including queries about travel plans or career coaching. Users also observed that other Chinese LLMs like Qwen have similar problems.
A screenshot of a RedNote user telling DeepSeek “I finally finished my exam and I missed you,” to which DeepSeek refused to respond.
The issues of censorship and server overload are limited to DeepSeek’s official website and app, and could be mitigated through localized deployment. But for most ordinary users in China, free platforms remain the primary gateway to AI tools. If accessing a smoother experience requires paying for a localized model, such as Tencent’s Yuanbao (which, according to some RedNote users, has less censorship), users may simply choose to pay for access to foreign models on Taobao.
Key Takeaway
China is not a monolith. The existence of this grey market highlights the decentralized nature of censorship, the patchiness of platform enforcement, and the diversity of public interest in AI. So far, Beijing seems either unconcerned with the political implications of U.S. models beyond ChatGPT, or simply uninterested in what might leak from them.
This market began well before DeepSeek’s rise and continues to draw users even after it. While DeepSeek has indeed sparked waves of techno-nationalist pride, many Chinese users still look beyond the Great Firewall.
Unless there is a sudden top-down crackdown, the market for U.S. LLMs is unlikely to disappear in China. The constant competition between ChatGPT vs DeepSeek or Grok vs DeepSeek does travel into the firewall, which will continuously make Chinese users eager to try them out and see which one is really better. The persistent anxiety of “use AI or be replaced by it” will only intensify amid an unresolved unemployment crisis. And, perhaps most importantly, the prices for proxy sites and transferred API are very cheap.
Although the frontier AI model developers and their respective countries are increasingly distant from one another, the models themselves remain strangely united and listed near each other in obscure corners of Chinese e-commerce platforms.
