On this page
GDPR applies to US companies as soon as they offer goods or services to people in the EU, paid or free, or monitor the behavior of people in the EU, for example with analytics profiles or retargeting pixels. You do not need an office, a server or a single employee in Europe for that. What you then need on your website is a lawful basis for each purpose, consent before you track EU visitors, a privacy notice written for them, and a legal route for every transfer of their data to the United States.
The General Data Protection Regulation (Regulation (EU) 2016/679) has applied since May 25, 2018. Article 3 sets its reach. Article 3(1) covers any processing in the context of an establishment in the EU. Article 3(2) covers a company with no EU establishment at all, if it targets people who are in the EU: by offering them goods or services, or by monitoring their behavior there. Citizenship does not matter; location does. A US citizen on vacation in Paris counts, an EU citizen living in Texas does not.
This guide is for a US business with a website, an online store, a SaaS product or a lead form that reaches Europe. It covers when the law applies, the EU representative, the Data Privacy Framework and the court case against it, and the changes a typical US site makes.
Offering goods or services: what counts
A website that people in the EU can simply open is not enough. The European Data Protection Board (EDPB), in its guidelines 3/2018 on territorial scope, looks for signs that you intend to serve people in the EU:
| Sign | Points toward targeting the EU | Points away from it |
|---|---|---|
| Language | a French, German or Dutch version of your site | English only, written for a US audience |
| Currency and prices | prices in euros, VAT shown | dollars only, US sales tax |
| Delivery | shipping to EU countries | US addresses only at checkout |
| Marketing | ads targeted at EU countries, EU customers named on the site | campaigns limited to the US |
| Domain and contact | a .de or .eu domain, an EU phone number | a .com with a US number only |
| The service itself | a SaaS your EU clients' staff log into | nothing for EU users |
No single sign decides; together they show intent. A B2B software company with EU customers is inside, because the people whose data it processes, the users at those customers, are in the EU. A US e-commerce store that ships to Germany and shows prices in euros is inside. A local US restaurant whose site happens to be read in Dublin is not.
Monitoring behavior: the trap for US sites
The second test catches more US companies than the first. Monitoring means tracking people on the internet to analyze or predict their preferences, behaviors or attitudes. Behavioral analytics, retargeting audiences, a Meta pixel building custom audiences, a session recorder: if they run on EU visitors, they monitor behavior in the EU.
That is why a US site with no European ambitions can still be inside GDPR for its tracking, even if it never sells anything in Europe. The fix is either to stop tracking EU visitors or to ask them for consent first, which the EU's cookie rules require anyway; see do I need a cookie banner.
Does GDPR apply to a company in the United States?
Do you have an office, branch or employee in the EU who handles the data?
Yes: GDPR applies to that processing under article 3(1), wherever the data is stored.
No: Go to the next question.
Do you offer goods or services to people in the EU, paid or free?
Yes: GDPR applies under article 3(2)(a). Signs: EU languages or currencies, shipping to the EU, EU customers named.
No: Go to the next question. A site that EU visitors can merely reach is not enough.
Do you monitor the behaviour of people in the EU?
Yes: GDPR applies under article 3(2)(b): analytics profiles, retargeting pixels or tracking that follows EU visitors.
No: GDPR does not reach this processing. US state privacy laws may.
Is your EU processing more than occasional, or does it include sensitive data?
Yes: Appoint an EU representative under article 27 and name it in your privacy notice.
No: The representative exception may cover you; check it with a lawyer.
Article 3 GDPR and the EDPB guidelines 3/2018 on territorial scope. The questions give the order of the test, not a legal opinion for your case.
The EU representative under article 27
A company that falls under article 3(2) has to appoint a representative in one of the member states where the people it serves or monitors are. The representative is the contact point for supervisory authorities and for individuals, and is named in your privacy notice. It is not your data protection officer and it does not carry your liability, but authorities can address enforcement to it.
There is one exception: processing that is occasional, does not include special category data or criminal records on a large scale, and is unlikely to result in a risk to people. A SaaS product with daily EU users does not fit it. A US manufacturer that answers a few EU inquiries a year by email may. Specialized firms offer representation as a service; have a lawyer confirm whether you need it.
If you also serve the United Kingdom, the UK has its own GDPR and its own representative rule after Brexit. The two have drifted apart since 2026; see UK GDPR vs EU GDPR.
Moving EU data to the United States
Every time EU personal data lands on a server in the US, or is read by your team in the US, that is a transfer under chapter V of the GDPR. It needs a legal route. Three exist in practice:
| Route | How it works | Fits when |
|---|---|---|
| EU-US Data Privacy Framework (DPF) | the receiving US company self-certifies with the Department of Commerce and appears on the DPF List; the EU adequacy decision of July 10, 2023 covers the transfer | you, or the US vendor receiving the data, are certified |
| Standard contractual clauses (SCCs) | the 2021 EU model clauses in the contract, plus a transfer impact assessment | the receiver is not certified, or you want a route that survives a court ruling against the DPF |
| Keeping the data in the EU | hosting and processing in an EU region, with access from the US limited and documented | your EU customers ask for it, or the data is sensitive |
The DPF is valid today. On September 3, 2025 the EU General Court dismissed the challenge brought by French member of parliament Philippe Latombe (case T-553/23), finding that the US safeguards for intelligence access under Executive Order 14086 were adequate. Latombe appealed to the Court of Justice on October 31, 2025 (case C-703/25 P), and the appeal is pending. The DPF's predecessors, Safe Harbor in 2015 and Privacy Shield in 2020, were struck down by that same court. That history is why many EU buyers ask US vendors to have the SCCs in the contract as a fallback.
How much this matters shows in the fines. Ireland's Data Protection Commission fined Meta 1.2 billion euros in May 2023 for transferring EU user data to the US without adequate protection. The Dutch Data Protection Authority fined Uber 290 million euros in August 2024 for sending European drivers' data to the US without a valid transfer tool for over two years. The top fine under the GDPR is 20 million euros or 4 percent of worldwide annual turnover, whichever is higher.
Where the data physically sits, and whether hosting in an EU region keeps it out of reach of US law, is a question of its own; see EU data residency.
What a US website changes for EU visitors
Most of the work sits on the website and in the tools around it. A checklist in the order we tackle it:
| Part of the site | What GDPR asks | What we change |
|---|---|---|
| Analytics and ad pixels | consent before tags that are not strictly necessary load for EU visitors | a consent banner for EU visitors with reject as easy as accept, tags wired to the choice |
| Web fonts and embeds | no data to third parties without a basis | fonts hosted on your own domain, video embeds that load on click; see are Google Fonts GDPR compliant |
| Contact and lead forms | a lawful basis per purpose, only the fields you need | fields cut back, a line on how the data is used, no pre-ticked marketing box |
| Privacy notice | who you are, purposes and bases, recipients, transfers, retention, rights, your EU representative | a notice written for EU readers; see do I need a privacy policy |
| Vendors | a data processing agreement with each processor | a list of vendors, their DPF certification or SCCs |
| Hosting and backups | a basis for each transfer, security fit for the risk | EU region where it makes sense, encryption, access logs |
| Requests from individuals | access, erasure, objection within one month | a mailbox and a process someone owns |
| Breaches | notice to the authority within 72 hours | a short runbook: who decides, who writes |
Two US habits need the most rethinking. First, opt-out is the American default for marketing and tracking; under GDPR it is opt-in. Second, CCPA compliance does not carry over: California asks you to honor an opt-out of sale and sharing, Europe asks for a lawful basis before you start.
A worked example: a US SaaS with EU customers
Take a software company in Austin selling a scheduling tool to small businesses, with 300 customers in Germany and the Netherlands. Its staff in the US log into the admin panel; the app runs in a US cloud region.
- Article 3(2)(a) applies: it offers a service to businesses whose users are in the EU, and it processes those users' data.
- It acts as a processor for its customers' data and a controller for its own marketing data. Its customers will ask for a processing agreement, and for its subprocessor list.
- It needs an EU representative: daily processing is not occasional.
- Transfers: either it self-certifies under the DPF, or it signs SCCs with each customer. Many EU buyers will ask for both.
- Its website tracks visitors with a remarketing pixel: EU visitors get a consent banner.
- Several German customers ask for EU hosting in their tender. Moving the app to an EU region answers that, and keeps US access as a documented exception.
None of this is exotic, but it is work, and it is much cheaper to design in than to retrofit after the first enterprise customer sends a security questionnaire.
What US founders ask about GDPR
Does GDPR apply to American companies?
Yes, when they offer goods or services to people in the EU or monitor their behavior, under article 3(2). An office or server in the EU is not required.
Is the Data Privacy Framework still valid?
Yes. The EU General Court upheld it on September 3, 2025 in the Latombe case. An appeal to the Court of Justice is pending, so many companies keep standard contractual clauses as a fallback.
Is CCPA compliance enough for GDPR?
No. CCPA lets people opt out of the sale or sharing of their data. GDPR asks for a lawful basis before processing and consent before tracking, plus rules on transfers that California law does not have.
Can the EU fine a company with no office in Europe?
Yes. Authorities can address decisions to the company and to its EU representative, and they have fined US companies directly, such as Uber with 290 million euros in 2024.