The General Data Protection Regulation (GDPR) is an EU law on data protection and privacy, which also applies in the European Economic Area (EEA). Whether it applies does not depend on a person’s nationality: it covers processing in the context of an organization’s establishment in the EU, wherever the people concerned are, and processing by organizations outside the EU that relates to offering goods or services to, or monitoring, people in the EU.

Applying to US Websites

The GDPR can also apply to organizations established outside of the EU, including US websites. A US-based website must comply with the GDPR when it processes the personal data of people in the EU in connection with offering them goods or services, or monitoring their behavior in the EU (for example, tracking them online to profile them or target ads). The fact that people in the EU can visit the website is not enough on its own.

For example, if a US-based e-commerce website sells products to customers in the EU (judged from all the circumstances together, such as offering delivery to EU countries, prices in euros with the option to order, and mentioning customers in the EU), it must comply with the GDPR when processing those customers’ personal data.

Applying to US Organizations

The GDPR also applies to US organizations when they process personal data in connection with offering goods or services to individuals within the EU or monitoring their behavior there. For example, if a US-based company operates an online store that sells products to individuals within the EU, it must comply with the GDPR when processing the personal data of its customers in the EU.

Conclusion

In conclusion, the GDPR applies to US websites and US organizations when they process the personal data of people in the EU in connection with offering them goods or services, or monitoring their behavior in the EU. A US organization that does neither, and has no establishment in the EU, is generally not subject to the GDPR just because people in the EU can visit its website.