Home › Resources

Does GDPR Apply to US Companies? The Territorial-Scope Test Explained

Published September 18, 2026

Yes, the GDPR can apply to US companies -- even those with no office, server, or employee in Europe. The regulation's reach is determined by whose data you process and what you do with it, not by where your business is incorporated. If your app or website collects personal data from people located in the European Economic Area (EEA), you may be subject to the full weight of the GDPR regardless of your company's size or location.

This guide breaks down the specific legal triggers in Article 3 of the GDPR, walks through concrete examples a US app developer would recognize, clarifies the situations that do not bring a US company within scope, and explains what compliance actually requires if the regulation does apply to you. If you want a quick answer on which privacy laws cover your specific setup, you can run a privacy law eligibility check based on your platforms and audience in under a minute.

The Short Answer: GDPR's Territorial-Scope Test

Article 3 of the GDPR defines three ways an organization falls within its jurisdiction. The first, Article 3(1), applies to any company that has an "establishment" in the EU -- an office, a subsidiary, or a branch. This one rarely surprises anyone. The two that catch US companies off guard are in Article 3(2):

• Article 3(2)(a) -- Offering goods or services. If your company offers goods or services to individuals who are in the EEA, the GDPR applies. The key word is "offers" -- you do not need to charge money or complete a sale. A free app available to EU users counts.
• Article 3(2)(b) -- Monitoring behavior. If your company monitors the behavior of individuals in the EEA, the GDPR applies. Behavior monitoring includes analytics tracking, cookie-based profiling, retargeting, location tracking, and any form of behavioral advertising aimed at EU users.

The test is about the data subjects' location at the time of processing, not their citizenship or residency. A French tourist visiting your website from Paris is an individual "in the Union" under Article 3. That same person visiting your site from New York is not.

Article 3 Triggers: Offering Services and Monitoring Behavior

When "offering goods or services" applies

The GDPR does not require you to explicitly target the EU market. Recital 23 of the regulation lists indicators that a company intends to offer services to EU individuals. If any of the following apply to your app or website, you are likely within scope:

• Your app is available on the EU App Store or Google Play Store in EU countries, and you have not geo-restricted it away from those regions.
• Your website offers content or pricing in an EU language (other than English) or displays prices in euros.
• You use a .eu or country-code top-level domain like .de or .fr.
• You mention EU-specific shipping, delivery, or customer support availability.
• Your marketing campaigns target EU audiences through Google Ads geo-targeting, Meta audience settings, or similar platforms.

For a US app developer, the most common trigger is the first one: publishing an app to a global app store without restricting EU availability. The moment a user in Germany downloads your free utility app and it collects their email address or device identifier, you are processing personal data of an individual in the Union under Article 3(2)(a).

When "monitoring behavior" applies

Article 3(2)(b) has a lower bar than most US developers expect. Recital 24 clarifies that monitoring includes tracking individuals on the internet to create profiles, analyze preferences, predict behavior, or serve personalized content. Concrete triggers include:

• Running Google Analytics, Mixpanel, Amplitude, or any analytics platform that collects IP addresses or device identifiers from EU visitors.
• Setting advertising cookies (Meta Pixel, Google Ads conversion tracking) that follow EU visitors across sites.
• Using session-recording tools like Hotjar or FullStory on pages accessible to EU users.
• Implementing push notifications or in-app messaging that tracks engagement behavior by user.

If your website or app is publicly accessible and you have not geo-blocked EU traffic, the analytics and advertising tools you already use are almost certainly monitoring the behavior of individuals in the EEA.

What Does NOT Trigger GDPR

Not every US company with a website falls under the GDPR. The regulation targets intentional engagement with the EU market, not incidental contact. These situations generally do not trigger GDPR obligations:

• A US-only service with geo-blocking. If your app is restricted to the US App Store and your website geo-blocks EU IP addresses, you are not offering services to or monitoring individuals in the EEA.
• Incidental EU traffic with no targeting. An EU tourist stumbling onto your US-only restaurant website does not, on its own, bring you within scope -- provided you have no EU-language content, no EU-targeted ads, and no intent to serve EU visitors. The European Data Protection Board (EDPB) has noted that mere accessibility of a website from the EU is not enough.
• B2B services sold exclusively to US companies. If your SaaS product is sold only to US-based businesses and you have no EU end users whose data you process, the GDPR typically does not apply. However, if your US client's EU employees or EU customers' data flows through your system, you may be a processor under the GDPR.
• Processing data of EU citizens outside the EU. Article 3(2) keys on the location of the individual at the time of processing, not their nationality. Data collected from an EU citizen who is physically in the United States at the time of collection is not covered by Article 3(2).

The gray area is small but real. If you are unsure whether your specific data flows bring you within scope, the safe practice is to comply -- the cost of basic GDPR compliance is far lower than the cost of a regulator inquiry. To map your situation to the privacy laws that apply, our privacy law checker walks through the relevant factors in a few clicks.

What You Must Do If GDPR Applies

If the Article 3 analysis puts your US company in scope, the GDPR requires a specific set of actions. These are not optional best practices -- they are legal obligations with enforcement behind them.

• Lawful basis for processing. Every category of personal data you collect needs a lawful basis under Article 6. For most US app developers, the relevant bases are consent (Article 6(1)(a)) for marketing and analytics cookies, and legitimate interest (Article 6(1)(f)) for core product functionality. You must document which basis applies to each processing activity.
• Transparent privacy policy. Articles 13 and 14 require you to tell users exactly what data you collect, why, who receives it, how long you keep it, and what rights they have. Generic or vague language does not satisfy the transparency requirement. Your privacy policy must name your lawful bases, your data retention periods, and the categories of third-party recipients. If you need a policy that covers GDPR requirements for your specific data practices, you can generate one for free with the privacy policy builder.
• Data subject rights. You must provide mechanisms for EU individuals to exercise their rights under Articles 15 through 22: access, rectification, erasure ("right to be forgotten"), restriction, data portability, and objection. You have one month to respond to a valid request.
• Data processing agreements. If you use third-party services that process personal data on your behalf (hosting providers, analytics platforms, email tools), Article 28 requires a written data processing agreement with each one.
• EU representative. Article 27 requires companies outside the EU that are subject to the GDPR to appoint a representative established in an EU member state. This representative acts as a local contact point for data subjects and supervisory authorities. Small-scale or occasional processing may be exempt, but most US companies serving EU users through an app or website do not qualify for the exemption.
• Data breach notification. Under Article 33, if a personal data breach occurs, you must notify the relevant EU supervisory authority within 72 hours of becoming aware of it. If the breach poses a high risk to individuals, Article 34 requires you to notify the affected individuals directly.

For a US company building an app that collects user data, the practical starting points are a GDPR-compliant privacy policy, cookie consent for non-essential tracking, and documented lawful bases. These three steps address the most common enforcement triggers. For a broader look at building a compliant policy, our guide on creating a privacy policy for a small business walks through required clauses step by step.

Penalties and Realistic Enforcement Risk

The GDPR's headline penalty numbers -- up to 20 million euros or 4% of annual global turnover under Article 83(5) -- are real, but the enforcement picture is more nuanced than the headlines suggest.

How fines actually work. Article 83(2) lists the factors supervisory authorities consider when setting fines: the nature and gravity of the infringement, whether it was intentional or negligent, what steps the company took to mitigate damage, the categories of data involved, and the company's degree of cooperation. The maximum is a ceiling, not a starting point. Most fines against small and mid-size companies are in the tens of thousands of euros, not millions.

Enforcement reality for small US companies. EU data protection authorities have limited budgets and prioritize enforcement actions against large-scale processors and repeat offenders. A US startup processing data from a few thousand EU users is unlikely to be the first target of a cross-border investigation. That said, enforcement activity has increased year over year since 2018, and several non-EU companies have received fines. Clearview AI, for instance, was fined by regulators in France, Italy, and Greece despite having no EU presence.

The real risk is not the fine itself. For most small US companies, the practical risks of non-compliance are reputational damage, loss of EU partnerships or customers who require GDPR compliance from their vendors, and app store enforcement. Both Apple and Google have tightened privacy requirements for apps in their stores, and a GDPR complaint from an EU user can trigger a review that affects your app's availability.

The pragmatic calculation: basic GDPR compliance -- a proper privacy policy, cookie consent, and documented data practices -- costs very little for a small company. The downside risk of ignoring the regulation entirely, while statistically small in any given year, carries disproportionate consequences if it materializes.

Frequently Asked Questions