Correct. It does not apply to US citizens residing anywhere in the world. It does, however, as I said, apply to EU citizens regardless of where in the world they reside.
If a company holds data about EU citizens, the GDPR applies to them, regardless of where that company is based. Including the US. Hence the statement "It (GDPR) does apply in the US" is completely correct.
But there's no jurisdictional reality that any of country/union A's rights will protect a person while they are present in country/union B.
In the same way that a US citizen does not have legal protection for free speech when present in, e.g. China, Saudi Arabia, or Germany.
Even if the EU got the text incorporated into the UN Universal Declaration of Human Rights, there are famously many countries who are not signatories (and it would require a locally-implemented actual law to support its recognition).
The EU can arrange post facto penalties for violations of their citizens' rights, to be (potentially) administered in the future, when a responsible entity enters EU jurisdiction, but absolutely not before then without cooperation by treaty with the nation where these foreign-and-not-real "rights" were violated. Which would be a surrender of sovereignty and basically unimaginable.
(No comment on the goodness or successfulness of the GDPR here, just that no part of it is relevant outside of the EU regardless of how the text is composed.)
(And this is all written with awareness that the US somehow manages to selectively enforce their laws extra-jurisdictionally in weak foreign nations. The EU is not the US, and the US is not weak.)
Just, that is why I wrote "it's just potentially harder for the EU to enforce meaningful penalties for infractions."
You premise is true in one sense, however, the point remains - the GDPR covers all EU citizens, regardless of where the company is based. For small US companies, sure the EU has very little power to enforce it, but larger companies that derive any revenue from the EU can be, and are, fined by the EU GDPR commissioners.
I can't find the source, but Google's AI in the search results also claims that "EU GDPR fines for U.S. companies are significant, with U.S. firms facing roughly 83% of total GDPR fines, totaling over €4.68 billion by early 2025". That 83% figure seems unreasonably high to me, but it's possibly just a consequence of the size of the fine being based on worldwide revenue and over half of the 20 biggest fines were to Google and Meta.
I get it, but the operative point is not "potentially harder", but "literally impossible" to enforce -- unless the corp has some presence in the EU of course.
FWIW, I just checked Wikipedia to sanity-check my memory of our lawyers' guidance. Important differences from our discussion, if my read is correct:
GDPR does not apply to "EU citizens anywhere in the world", it applies to the personal data of "living persons ... inside the EU" or with data processed there.
(So GDPR would apply to a US citizen who is present in the EU, and/or being a user/customer of a vendor that operates in the EU)
From the "Misconceptions" section[0]:
> ## Misconceptions
>
> GDPR applies to anyone processing personal data of EU citizens anywhere in the world
>
> In fact, it applies to non-EU established organizations only where they are processing data of data subjects located in the EU (irrespective of their citizenship) and then only when supplying goods or services to them, or monitoring their behaviour.
(So GDPR would not apply to a EU citizen who is present in the US at the time of "processing", whether that's a service or product sale, etc)
This is important to my company. We are US-based, but have EU citizens as customers. For regulatory reasons, we block customer activity from outside the US, and we are not able to comply with GDPR (but we do have to be aware of CCPA[1] which has some similarities).
I'm not sure I agree with that interpretation, as "processing" is extremely broad and includes just storing the data.
Yes, technically if the EU citizen remains outside the EU for the entire lifecycle of the data up to and including deletion, then it isn't covered. But if you store that data at all when they have returned to the EU, then you need to comply with the GDPR in terms of handling that data.
Also, as a UK citizen (formally EU citizen), I don't understand why US-based countries are so against the GDPR, as essentially it's just a codification of how to do the morally best thing for your customers. Any data you don't need for a business purpose should be deleted as soon as possible. You can have any data about someone as long as there is a justifiable business reason for it. You have to let someone know what data you have about them (if they request it via a SAR) and you have to give them the information up front to determine if they are happy with you handling their data, via a clear privacy policy and opt-in to having their data used.
Complying with the GDPR is pretty straight forward, as long as your intention isn't to profit by selling or otherwise making use of people's data in ways that they wouldn't be comfortable with. If you aren't doing anything bad with user's data and already following good security practices, including deleting data that's no longer needed, then you are already compliant with the intent of the GDPR and going from that to full compliance is probably only adding processes to be able to handle an SAR.
I'd have to dig deeper, but generally "storing" (or maintaining storage) is not "processing" in the local US legal vernacular. Where both apply (PCI DSS, etc), both terms are used.
In my personal (business) case, we literally cannot comply with GDPR and also BSA/AML, FinCen, Reg E, KYC, etc, simultaneously. Our "business requirements" can last 7+ years, and our customers' wishes have no bearing on them.
And while we have no operations in any EU country, we are absolutely not obligated to even consider any EU laws about the data belonging to any of our customers, regardless of their citizenship. That's the primary point I'm making here -- the EU has zero jurisdiction over anything that happens outside the EU, ever, or any entities outside the EU, despite any claims to the contrary (which, according to Wikipedia at least, are not even made).
This is intuitive, but also the very expensive legal opinion of our lawyers, who have offices in the US, EU, and EMEA, for whatever that's worth!
In the general case, and as a customer, I'm fully in support of GDPR and CCPA-like protections. They're a great idea, I think! I'm usually the privacy nut in any discussion.
But compliance is obviously more work/expense than not, and small companies are especially allergic to nonproductive work and expenses. So naturally there's resistance to the suggestion that a foreign law compels them to do more of both.
And of course, if we're talking about the US, we have a very different culture around government and regulation. "As little as possible" (except those that protect my interests) is the preference of the landed gentry, and those who would aspire to same.
Reasonable people will recognize this as absurd, but ... you can't spell "absurd" without U, S, and A.
Absolutely agree, effectively the EU can't touch small companies, they'd only be able to touch you if you generated any revenue in the EU that they could intercept.
As for "the EU has zero jurisdiction over anything that happens outside the EU, ever, or any entities outside the EU, despite any claims to the contrary" again, this isn't true if you conduct any business in the EU. Even for a company domiciled outside the EU, they could compel your payment processors to seize all payments to you from EU entities, for instance. The degree to which they'd fight pushback would depend on how serious the violation was and the size of the company, but you can be sure for instance that even if say Google had no EU presence at all, that the EU would make sure they complied with the GDPR or else ban them from the EU entirely.
In your situation, you actually have a good defence if there ever was an EU citizen trying to use the GDPR against you, because by taking efforts to not allow sales outside the US, you can argue that your services were never for sale to EU citizens. I guess if your TOS also said your service wasn't available to EU citizens, it would be even more watertight.
But just FYI for this:
> In my personal (business) case, we literally cannot comply with GDPR and also BSA/AML, FinCen, Reg E, KYC, etc, simultaneously. Our "business requirements" can last 7+ years, and our customers' wishes have no bearing on them.
I don't know the requirements of all those other things, but contrary to what a lot of people believe - you CAN store whatever you need to if there is a justifiable business reason for it, and you don't have to delete it even if a customer requests you to if there is a valid business requirement, such as regulatory or statutory compliance. The GDPR just compels you to be transparent with the data subject about what data is stored in those cases.
Almost every business in the EU is required to hold tax records of sales for 5 years, and so obviously these must be retained even after a customer stops being a customer and even if they request deletion of their PII data. What the GDPR requires is that you only keep the minimum required data to fulfill those statutory requirements, and delete anything else, and also not to use that data for any other purpose. Regular data should be deleted as soon as it is no longer needed.
I haven't studied the CCPA in depth, but my understanding is that it's very similar in scope to the GDPR and that complying with one would get you almost all the way to compliance with the other.
I also understand the general reaction against being told what to do by some other extra-territorial entity, but in today's society of cross-border trade, it's usually inescapable, apart from when they directly contradict - e.g. requirements to only store data in one territory.
The EU can theoretically sanction entities with establishment inside the EU, for actions outside the EU. I'm not sure if GDPR allows this, but (as a terrible example), I've read of laws to punish foreign travel for underage sex tourism. However entities with no such establishment cannot be punished judicially by the EU because there is no mechanism.
The EU could block network traffic to an offending extraterritorial entity, which might cause them to suffer losses (e.g. advertising volume if nothing else), but the EU cannot fine or arrest the entity or its officers as punishment.
I think we largely agree at the root of things. There's some imprecision in language around words like "apply" and "relevant".
I have only dug this deeply on GDPR because we, as a corporation, want to comply with the most consumer-friendly policies that we are able to. Obligations (e.g. CCPA because we are in the US) are table stakes, but we aim for more. Our lawyers tell me to stop worrying about the GDPR at all, and I am confident that they are correct legally (and financially), but as we all know it is more efficient to design systems that do things properly at the outset (or at least under minimal time pressure), instead of urgently retrofitting later.
If a company holds data about EU citizens, the GDPR applies to them, regardless of where that company is based. Including the US. Hence the statement "It (GDPR) does apply in the US" is completely correct.