GDPR in the US: Does GDPR Apply to US Companies?

General Data Protection Regulation (GDPR) applies to any US company that offers goods or services to people in the European Union (EU) or monitors their behavior there. You do not need an EU office, and the law applies to specific processing activities, not your entire company.

Since 2022, four EU data protection authorities have fined Clearview AI a combined €90.5 million for scraping Europeans’ photos for a facial-recognition database: Italy €20 million, Greece €20 million, France €20 million and the Netherlands €30.5 million. France added a €5.2 million penalty for ignoring its order, bringing the total to €95.7 million. The UK also issued a £7.5 million penalty in 2022. A tribunal overturned it in 2023, but the Upper Tribunal reinstated the regulator’s jurisdiction in October 2025 and sent the case back. Clearview is a US company with no establishment in Europe. This case shows how far GDPR can reach into the US, and where its limits are.

If you run a US business, understanding GDPR in the US starts with knowing whether the law applies to your business, what regulators look for, and what steps to take first.

Does GDPR apply in the US?

Yes. GDPR applies to any US company that offers goods or services to people in the EU or monitors their behavior there. No EU office required, and it attaches to specific processing activities, not the company as a whole.

Article 3 gives the regulation three routes to a US company.

• EU establishment. An office, a branch, even a stable sales arrangement pulls the whole entity in for the processing that establishment touches.
• Offering goods or services to people who are in the EU, paid or free. This is the route that matters most for companies with no European footprint.
• Monitoring the behavior of people in the EU, which your website’s tracking stack may already be doing.

The law applies based on your activities, not where your company is registered. For example, a Texas LLC with EU customers has the same obligations as a French company for those activities. A company can be covered by GDPR for its EU-facing business, but not for its US-only operations.

The full applicability walk-through lives in the explainer’s self-test.

What pulls a US company into GDPR scope?

Offering is proven by targeting signals like EU languages, euro pricing, EU delivery, or ads aimed at the EU. Monitoring means tracking the behavior of people in the EU. Simply having a site that can be accessed from the EU does not count as either.

The two triggers look similar from a distance. Up close, they behave very differently. Offering is an intent test: regulators ask whether your operation is reaching toward the EU market. Monitoring is the behavior test, where regulators ask what your site actually does to EU visitors. You can fail the first on paperwork and fall into the second by default configuration.

What counts as offering goods or services to people in the EU?

The key factor is intent, and you must show it. Recital 23 explains that just having a website people in the EU can access, or listing an email address or contact details, is not enough to show you are offering to the EU. Using a language common in your own country, like English for a US site, also does not mean you are targeting Europe by default.

Payment is irrelevant. A free app, free trial, or newsletter aimed at EU users counts as offering services just as much as a paid storefront does.

A traveler example helps clarify the rule. If an American customer uses your US-only service while on vacation in Spain, that does not count as offering to people in the EU. What matters is whether you designed your service to reach EU users, not where someone happens to be.

If you want to be sure, you can block EU visitors from your site. Some US businesses, like local news sites, did this in 2018 instead of complying with GDPR. However, this means losing all EU visitors, and geo-blocks are not perfect. For most growing companies, it is better to ask whether the rules already apply to them, rather than how to avoid them.

What counts as monitoring EU visitors?

Monitoring under Article 3(2)(b) means tracking people in the EU online, or profiling them, to analyze or predict their behavior. The EDPB’s Guidelines 3/2018 on territorial scope list examples of what regulators consider monitoring:

• Behavioral advertising
• Geolocation activities, particularly for marketing
• Online tracking through cookies or other techniques, such as fingerprinting
• Personalized diet and health analytics services
• CCTV
• Market surveys and behavioral studies based on individual profiles
• Monitoring or regular reporting on an individual’s health status

Serving web pages is not, by itself, monitoring under this provision. Monitoring involves behavioral analysis, not general website operation. But common growth tools, including behavioral advertising, cookie-based tracking, and fingerprinting, fall within the examples listed in the guidelines.

If you process EU personal data on behalf of EU customers as a processor, that alone does not automatically bring you within Article 3(2). Its application depends on the circumstances and the relevant territorial-scope provision.

Does running Google Analytics or the Meta Pixel count as monitoring?

By the letter of the EDPB’s own list, online tracking through cookies and behavioral advertising are monitoring. Standard analytics and advertising pixels are exactly that. The strongest regulatory evidence comes from the post-Schrems II analytics rulings. Austria’s data protection authority ruled that a website’s use of Google Analytics violated the GDPR (decision GZ D155.027 of 22 December 2021, hosted by noyb, which brought the complaint). 

France’s CNIL followed with a 10 February 2022 formal notice ordering a French website operator to stop transferring visitor data through Google Analytics. 

One precision before anyone over-reads that. The analytics rulings were decided on data-transfer grounds, not as Article 3(2)(b) scope determinations. The rulings say regulators treat routine analytics deployments as GDPR-regulated tracking of EU visitors. The scope point itself comes from the EDPB’s monitoring list above, which names the technology category outright.

Does GDPR apply to US citizens or EU citizens in the US?

GDPR protects people in the EU regardless of their passport: a US citizen in Berlin is covered; an EU citizen in New York dealing with a US company is not.

The law is based on where the person is, not their citizenship. The EDPB guidelines make it clear that nationality does not matter. The same rule covers Iceland, Liechtenstein and Norway, where GDPR has applied since July 2018 under the European Economic Area (EEA) Agreement.

Coverage attaches while the person is in the EU. A tourist from Ohio is protected during her two weeks in Lisbon, including by US companies whose services she uses there. California’s CCPA runs on a different axis. It protects California residents, not people in a place. That is one reason “we handle CCPA” does not answer the GDPR question.

When does GDPR not apply to a US company?

GDPR does not apply only if you do not target or monitor anyone in the EU and have no EU presence. Company size is never an exemption. The only size-based relief, in Article 30(5) about record-keeping, is much narrower than it sounds.

A US company is genuinely out of scope in only a few situations.

• A US-only business serving US customers, with no EU-directed marketing, no EU delivery, no EU-language or euro pricing, and no behavioral tracking aimed at people in the EU.
• A company whose EU touchpoints are purely incidental: a European finds you, signs up, and you never built anything to reach them (though a sustained, growing EU user base can itself become evidence of targeting, and borderline cases deserve the explainer’s self-test).
• Purely personal or household activity, which falls outside the regulation entirely.

If that’s you, stop worrying. This is the honest boundary, and plenty of US businesses are genuinely out.

Are small US businesses exempt from GDPR?

No. There is no revenue or employee threshold, and no small-business exemption in the regulation.

What exists is one narrow piece of relief: Article 30(5) excuses organizations with fewer than 250 employees from keeping the Article 30 record of processing activities. Unless, that is, the processing is likely to result in risk, is not occasional, or includes special-category or criminal-conviction data. Those three defeaters swallow the exemption: the joint reading of Germany’s supervisory authorities (the Datenschutzkonferenz’s guidance on the Article 30 record, February 2018) is that routine customer data or employee data is by nature “not occasional,” which pulls essentially every operating business back in. And even for the rare firm that qualifies, Article 30(5) waives one documentation duty. It exempts nothing else.

The EU’s Omnibus IV package (procedure 2025/0130(COD)) would rewrite that relief: the Commission proposed raising the threshold to 750 employees, and Parliament and Council raised it further in negotiation. Its agreed text exempts organizations with fewer than 1,000 employees and limits the record duty to specific processing activities likely to result in high risk. 

As of October 2026, the package has a trilogue agreement (Council’s Coreper confirmed it on 26 June 2026) but has not been adopted; a plenary vote is forecast for 23 November 2026. Until adoption, the 250-employee rule stands as written. Its three defeaters stand too.

Is there a US equivalent of GDPR?

No. The US has no federal law equivalent to GDPR. The closest is California’s CCPA/CPRA, an opt-out regime with revenue thresholds, against GDPR’s opt-in, threshold-free model.

US data privacy laws are a patchwork. Sectoral statutes cover slices of it: HIPAA (the Health Insurance Portability and Accountability Act) for protected health information held by healthcare providers and other covered entities,GLBA for financial institutions, COPPA for children’s data, implemented through the Federal Trade Commission’s COPPA Rule. State data privacy laws sit on top: 23 states had enacted comprehensive data privacy laws as of June 2026, per the IAPP’s tracker. Our data privacy regulations article maps them state by state.

The closest analog to GDPR is the California Consumer Privacy Act (CCPA), amended by the California Privacy Rights Act (CPRA). And the structural distance is the whole story.

GDPR vs. the California Consumer Privacy Act

The practical takeaway runs one direction. Genuine GDPR compliance covers most state-law duties (notice, rights handling, security, vendor contracts), but CCPA compliance leaves the opt-in consent model, the lawful-basis requirement, the EU representative duty, and the transfer rules untouched.

What happens if a US company ignores GDPR?

EU data protection authorities can issue fines up to €10 million or 2%, or €20 million or 4% of worldwide turnover. But against a company with no EU presence or assets, there is no treaty to collect these fines in US courts. The real risks come from EU representatives, EU customers, market access, and any future EU presence.

Article 83 has two tiers: 

• up to €10 million or 2% of worldwide annual turnover for the administrative tier (which covers, among others, record-keeping, security, breach-notification, and EU-representative failures)
• up to €20 million or 4% of worldwide annual turnover for the substantive tier (principles, lawful bases, data subject rights, unlawful transfers)

In each case, the higher figure applies, per infringement case, not per violation. 

The tier-by-tier detail is covered in our GDPR explainer. What matters for risk planning is that both ceilings key off worldwide turnover, so US revenue counts.

Can EU regulators actually collect fines from US companies?

There is no treaty mechanism specifically for enforcing EU administrative fines in US courts, and US law generally weighs against recognition. The Uniform Foreign-Country Money Judgments Recognition Act excludes fines and penalties from recognition. The Sedona Conference’s Working Group 11 also examined the question in its Commentary on the Enforceability in U.S. Courts of Orders and Judgments Entered under GDPR, a practitioner and academic analysis rather than case law.

A report on extraterritorial enforcement of GDPR, prepared for the EDPB by an outside expert in April 2024 (it states that it does not necessarily reflect the EDPB’s official position), concludes that DPA penalty decisions “would be effectively unenforceable in the United States” because they are penal in nature and “no statute or international agreement” authorizes their enforcement there. The same report notes there is no known precedent of a US court recognizing a foreign country’s penalty judgment on comity grounds.

That creates a significant collection gap. Clearview AI is a useful example. The company has no EU establishment and, according to the available information, no attachable EU assets. Its record with European regulators illustrates the gap:

The total is €95.7 million in final EU fines. As of October 2026, no public record has been located showing that any of these fines has been collected from Clearview AI. But regulators have other ways to apply pressure that do not depend on collecting administrative fines through US courts.

The first lever is people. When it announced the €30.5 million fine, the AP also said it was investigating whether Clearview’s directors could be held personally liable. Chairman Aleid Wolfsen said in the AP’s announcement:

“We are now going to investigate if we can hold the management of the company personally liable and fine them for directing those violations.”

The second lever is criminal law. On 28 October 2025, the privacy organization noyb filed a criminal complaint against Clearview and its managers with Austrian prosecutors, invoking Article 84 GDPR and §63 of the Austrian Data Protection Act. That route seeks to hold individuals accountable through criminal proceedings rather than administrative fines. As noyb stated in its announcement, it took the criminal route because criminal law lets prosecutors act against the company’s managers personally and use EU-wide criminal procedures.

The remaining levers are commercial and operational, and they may be more consequential for many US companies.

• EU representatives. Appointing an Article 27 representative gives regulators a domestic contact for orders and correspondence. The representative’s role is covered in the section below.
• EU customers and partners. Enterprise procurement and data-protection diligence can screen vendors for GDPR compliance. An unwillingness to address EU privacy obligations can become a deal-breaker even when a fine is difficult to collect.
• Market access and processing bans. Under Article 58(2), a DPA can prohibit or restrict processing. Such orders can have significant operational consequences, as illustrated by the Irish DPC’s decision concerning Meta’s EU-US data transfers.
• EU assets and future presence. A fine that cannot be collected today may become easier to enforce if the company later establishes an EU subsidiary, acquires EU assets, or develops a greater EU presence. Executive travel alone does not automatically make a corporate fine collectible.
• Private claims. Article 82 provides a right to compensation for qualifying GDPR infringements. The same outside-expert report draws an important distinction: a court judgment awarding compensatory damages to injured individuals would likely be eligible for recognition in US courts, subject to the usual requirements, while punitive administrative fines would not.

The mega-fines that make headlines tend to involve multinational companies with EU establishments, revenue, or assets, such as Meta, Amazon, Uber, and TikTok. Regulators can often reach those companies through their EU presence. DLA Piper’s annual GDPR survey put total fines at roughly €1.2 billion for 2025, based on the law firm’s tally rather than an official regulator-wide aggregate.

A US small or medium business with no EU presence faces different risks. Instead of large fines, the bigger concerns are being blocked from EU customers, flagged in a partner’s due diligence, or ordered to stop certain processing activities.

Do you need an EU representative, and is that the same as a data protection officer?

If the scope triggers pull you in and you have no EU establishment, Article 27 generally requires a written appointment of an EU representative, unless an exemption applies.

The representative is your designated contact point inside the EU. Regulators and data subjects can address it, it makes your Article 30 record available, and it must be established in a member state where your data subjects are. Two things it is not: a liability shield (Article 27(5) says the appointment is “without prejudice to legal actions which could be initiated against the controller or the processor themselves”), and a Data Protection Officer. Different roles, different triggers, different jobs.

When is the EU-representative exemption real?

Article 27(2) has two limbs. Limb (b) exempts public authorities and bodies. For everyone else, limb (a) applies only where the processing meets three cumulative conditions. The processing must be occasional. It cannot include large-scale processing of special-category (Article 9) or criminal-conviction (Article 10) data. And it must be unlikely to result in a risk to people’s rights and freedoms.

All three must hold at once. Ongoing EU marketing, a standing analytics stack, or a live EU customer base may indicate that processing is not occasional, depending on the circumstances. These activities do not automatically rule out the exemption in every case. If you rely on it, assess the actual processing against all three conditions, taking into account the EDPB’s guidance on the GDPR’s territorial scope.

Skipping a required appointment is itself a fineable violation under Article 83(4)(a), which provides for fines of up to €10 million or 2% of the undertaking’s total worldwide annual turnover for the preceding financial year, whichever is higher. There is a precedent: the Dutch AP fined LocateFamily.com €525,000 on 12 May 2021 for failing to appoint an EU representative.

EU representative vs. DPO: what’s the difference?

How do you appoint an EU representative?

The appointment comes down to three mechanical steps.

1. Pick the member state. The representative must be established where your EU data subjects are. If your users cluster in Germany, a German representative may be a practical choice, provided the location requirement is met.
2. Sign a written mandate. Article 27 requires a written designation. The representative acts on your behalf for regulator and data-subject correspondence under the mandate’s terms.
3. Publish the appointment. Articles 13(1)(a) and 14(1)(a) require the representative’s identity and contact details in the relevant privacy notices. Include them where those transparency obligations apply.

The DPO question, briefly. Article 37 makes a Data Protection Officer mandatory in three cases: 

1. you are a public authority, subject to the statutory exception for courts acting in their judicial capacity
2. your core activities require regular and systematic large-scale monitoring
3. your core activities involve large-scale special-category or criminal-conviction data. 

Most US SMBs in GDPR scope do not hit those triggers. Our GDPR explainer covers the DPO trigger analysis in depth. One trap is worth knowing: appoint a DPO voluntarily and you take on the full statutory obligations of the role anyway, so “voluntary” is a commitment, not a gesture.

How do EU-US data transfers work for a US company?

Transferring EU personal data to the US requires a legal safeguard. The practical route is EU–US Data Privacy Framework self-certification (valid today, with a court challenge pending as of October 2026), with Standard Contractual Clauses plus a transfer impact assessment as the standing fallback.

Cross-border data transfers are the one place “we’re a US company” bites mechanically: GDPR Chapter V restricts sending EU personal data to the US at all, regardless of whether you target the EU market. Three doors exist:

1. The EU–US Data Privacy Framework. The Commission’s adequacy decision of 10 July 2023 makes transfers to DPF-certified US companies lawful without further paperwork: self-certify at dataprivacyframework.gov, commit to the principles, re-certify annually. Two cautions: your vendors’ certification is not yours (each controller certifies for itself), and the legal posture is date-stamped. 
2. Standard Contractual Clauses plus a transfer impact assessment. The 2021 SCCs remain the standing fallback: contract modules with the data exporter, paired with a documented assessment of whether US law lets the importer actually honor them (the post-Schrems II requirement). More work, more durable.
3. Derogations. Article 49‘s narrow exceptions (explicit consent for the specific transfer, contractual necessity) are for occasional, specific transfers, not for running your business on.

Getting this wrong produced the largest GDPR fine on record (Meta’s €1.2 billion in May 2023, with a suspension order on EU–US flows) and Uber’s €290 million from the Dutch AP in August 2024. Both were transfer cases. The doctrine to land on: certify under the DPF and keep SCCs executed as the fallback.

Does a US website need a GDPR cookie banner?

You only need a GDPR cookie banner if your site targets or monitors EU visitors. In that case, you must get opt-in consent before using any non-essential cookies, make rejecting as easy as accepting, and ensure nothing non-essential runs before consent is given.

Two laws stack here, and being honest about the stack matters. The ePrivacy Directive’s Article 5(3) is what actually mandates consent before storing or accessing information on a visitor’s device: cookies, pixels, SDK identifiers. 

GDPR supplies the standard that consent must meet: freely given, specific, informed, unambiguous, and as easy to withdraw as to give. Whether ePrivacy’s own territorial reach covers a purely US-operated site with no EU targeting is a genuine gray zone. The directive predates GDPR’s extraterritorial drafting and was never written with the same reach in mind, so treat it as unsettled rather than settled in either direction. One thing is not gray. If GDPR’s monitoring trigger applies to your site (and behavioral advertising or cookie-based tracking aimed at EU visitors is exactly that), GDPR’s consent standard governs the tracking regardless.

A compliant banner for EU visitors, in checklist form:

• Nothing non-essential fires before consent: no analytics, no ad pixels, no session replay on the first paint.
• Rejecting is as easy as accepting: a “reject” option on the first layer, same visual weight as “accept.”
• Consent is granular and recorded. You can show who consented to what, when.
• No pre-ticked boxes, no dark patterns, no “by continuing to browse you accept.”

A cookie banner is just one part of compliance. If the choices recorded by your banner do not match your website’s actual data collection practices, this can be used as evidence against you.

The US approach is different. State laws like California’s use opt-out notices and respect browser-level Global Privacy Control signals. It is common and acceptable to show different consent banners by location, such as opt-in for EU visitors and opt-out for US visitors.

What must a US company actually do to comply?

In dependency order: confirm your scope and role, build the Article 30 record first (regulators ask for it first and everything else derives from it), then lawful bases, notices, consent mechanics, rights handling, security, breach process, vendor contracts, transfer mechanism, appointments, and the ongoing evidence habit.

The order is the point. Each step feeds the next, and starting anywhere else produces rework. Once the record exists, the middle steps can run in parallel: the customer-facing pieces (notices, consent mechanics, rights handling) alongside the contractual ones (vendor terms, transfer mechanism). The record and the appointments cannot; everything waits on those.

1. Confirm scope and role. Write down your in/out verdict and whether you are a data controller or a data processor for each data flow (Article 3, Article 4).
   Done when: you have a one-page scope memo someone could defend to a regulator.
2. Build the Article 30 record. Inventory all your data processing activities: purposes, data categories, recipients, transfers, retention. This is the keystone: regulators ask for it first, and lawful bases, notices, and data protection impact assessments (DPIAs) all derive from it.
   Done when: the record covers every system and vendor that touches personal data. (The record-of-processing guide walks the format.)
3. Assign a lawful basis per activity. Contract, legitimate interests, consent, legal obligation: one per purpose, documented (Article 6).
   Done when: every row of the Article 30 record carries its basis.
4. Fix your notices. Privacy policy and collection-point notices must name the controller, purposes, bases, recipients, transfers, rights, and your EU representative (Articles 13–14).
   Done when: the notices match the record.
5. Get consent mechanics right. If anything non-essential runs on your site for EU visitors, the consent layer above applies (Article 7, ePrivacy).
   Done when: nothing non-essential fires pre-consent and rejections are honored in fact.
6. Stand up rights handling. Access, deletion (the right to erasure, or “right to be forgotten”), data portability, objection, with a one-month response clock (Articles 12, 15–22).
   Done when: a test request gets answered within the deadline end-to-end.
7. Document data security. Technical and organizational security measures proportionate to the risk (Article 32).
   Done when: the measures are written down, not just practiced.
8. Prepare the breach process. Seventy-two-hour regulator notification for qualifying breaches, with a documented internal escalation path (Article 33). Our privacy incident guide covers the mechanics.
   Done when: someone can name who gets called at hour one.
9. Paper your vendors. A data processing agreement with every processor: instructions, security, sub-processors (Article 28).
   Done when: every vendor in the Article 30 record has a DPA on file.
10. Pick your transfer mechanism. DPF certification or SCCs plus TIA, per the transfers section above. Done when: every EU–US flow in the record names its mechanism.
11. Make the appointments. EU representative under Article 27 (and a DPO only if Article 37 actually triggers), per the representative section above.
    Done when: the mandate is signed, and the notices name the representative.
12. Build the evidence habit. Accountability means demonstrating compliance (records, assessments, logs, review cycles, per Article 5(2)) and running a data protection impact assessment before high-risk processing (Article 35).
    Done when: the file exists, and something in it was updated this quarter.

What does GDPR compliance cost a US business?

Estimate costs based on the main cost drivers (data complexity, transfers, special-category data), then price fixed items using published rates: an EU representative, consent tooling, and an outsourced DPO if required.

What actually drives cost:

• Data complexity: How many systems, vendors, and data categories your Article 30 records need to cover.
• Transfer volume: How many EU–US data flows need transfer mechanisms and assessments.
• Special-category data: Health data, biometric data, and similar sensitive data can mean DPIAs, tighter security, and a DPO if GDPR’s requirements apply.
• Rights-request volume: An EU customer base means handling real data subject requests, not just having a template.

Everything else (records, notices, rights processes, and vendor agreements) is mostly labor, and that’s where costs vary most. Budget for the downside, too. Not just the Article 83 fine ceilings, but deals that stall during due diligence when an EU customer asks for your Article 30 records or your representative’s details, and you have neither.

Is your site already doing what GDPR calls monitoring?

Observed behavior is the only evidence that answers it. Everything so far treats scope as a legal question; underneath it sits an empirical one. The monitoring trigger is decided by what your site’s tags actually do (which requests fire, to whom, carrying which identifiers (cookie IDs, IP addresses), under which consent state), not by what your privacy policy says or what you intend. Most US operators have never observed that behavior directly. They have read their policy. Few have watched the wire.

MELURNA is designed to observe what your site actually sends, to whom, and under which consent state. Our job is to watch the data flow, which is why we trust request logs more than privacy policies. MELURNA compares data movement after users accept, reject, take no action, or use Global Privacy Control signals. It highlights any data sent before consent and tracks where data goes. This helps you spot any gaps between what your banner records and what actually happens.

MELURNA maps observed behavior against GDPR and 30+ frameworks, on a public-facing journey, with no agents, integrations, or internal-system access required.

See what your site actually sends →

FAQs

DISCLAIMER: This guide is for general informational purposes only and does not constitute legal advice. While we strive for accuracy, we make no warranties about the completeness or reliability of this information, and are not liable for any errors, omissions, or actions taken based on its contents. Consult a licensed attorney for guidance specific to your business.