The General Data Protection Regulation is a European law, but its reach is global. GDPR applies to a US company in two cases: when it has an establishment in the EU, or when it targets people in the EU, either by offering them goods or services or by monitoring their behaviour there, for example with behavioural advertising or tracking cookies. No office in Europe is required. A website that people in Europe can merely reach is not caught by that alone.
That extraterritorial reach still catches many US companies off guard. As of 16 October 2026, the CMS GDPR Enforcement Tracker lists fines totalling about 7.57 billion euros since May 2018, and the largest of them were imposed on US technology companies.
GDPR in the US: the two Article 3 tests
Article 3 of the GDPR defines the regulation's territorial scope through two tests. Meet either one, and your business is subject to the full weight of EU data protection law for that processing.
The establishment test applies if your company has any form of presence in the EU - an office, a subsidiary, even a single employee conducting business activities within a member state. Data processing connected to that establishment falls under GDPR, regardless of where the actual servers sit.
The targeting test is broader. It applies when a company outside the EU either offers goods or services to individuals located in the EU, or monitors their behaviour within EU territory. Offering an EU language or currency, delivering to EU addresses or advertising to EU audiences points to an offer. Behavioural advertising, profiling or tracking EU visitors with cookies, for example through Google Analytics, can count as monitoring.
The European Data Protection Board (EDPB) draws the line in its Guidelines 3/2018 on territorial scope. Recital 23 says the mere accessibility of a website in the EU is not enough, and the EDPB adds that monitoring implies "a specific purpose in mind" for collecting and reusing data about a person's behaviour. A stray visit from Europe does not, on its own, bring a US site into scope.
Crucially, GDPR protects people based on their location, not their citizenship, but only when the company targets them there. The EDPB's own example is a US news app aimed only at the US market and priced in US dollars: when a US citizen uses it on holiday in Europe, that data collection is not subject to the GDPR. An EU citizen living in New York does not get GDPR protection for data collected while they are stateside, unless the processing is linked to an offer or monitoring in the EU.
Does the GDPR reach your US company?
What the GDPR requires once it applies
Once GDPR applies, the obligations are identical to those facing EU-based businesses. There is no lighter version for non-EU companies.
| Requirement | What it means in practice |
|---|---|
| Lawful basis (Article 6) | Every data processing activity needs a documented legal ground: consent, contract performance, legal obligation, vital interests, public task, or legitimate interest |
| Cookie consent | Non-essential cookies require informed, specific, freely given consent before they fire - not a "by continuing to browse" notice |
| Privacy notice | Clear disclosure of what data you collect, why, who receives it, and how long you keep it |
| Data subject rights | You must handle access requests, deletion requests, and portability requests within one month |
| Data Protection Impact Assessments | Required for high-risk processing - profiling, large-scale tracking, or processing special category data |
| Breach notification | Report qualifying breaches to the relevant supervisory authority within 72 hours |
| EU representative | Article 27 requires non-EU companies caught by the targeting test to appoint a representative in an EU member state, unless the processing is occasional and low risk |
The EU representative requirement trips up many US businesses. If you have no establishment in the EU but GDPR applies to your processing activities, you need a designated contact point within the EU for data protection authorities and data subjects to reach. Article 27(2) of the GDPR exempts processing that is occasional, does not include large-scale processing of special category or criminal offence data, and is unlikely to result in a risk to people. The EDPB reads "occasional" narrowly, so a website that tracks EU visitors every day rarely qualifies. Failing to appoint a representative when one is needed is itself a breach of the GDPR.
How EU authorities enforce GDPR against US companies
Enforcement comes from EU data protection authorities (DPAs), not US regulators. Each EU member state has its own DPA, such as the CNIL in France and the DPC in Ireland. The UK, outside the EU, has its own regulator, the ICO, which enforces the separate UK GDPR. These bodies have full investigative and sanctioning powers over any company whose processing falls under their law, regardless of where it is headquartered.
The fines have been substantial. Meta received a record 1.2 billion euro fine from the Irish DPC in May 2023 for transferring EU personal data to the US without adequate safeguards. The Dutch DPA fined Uber 290 million euros in 2024 for transfers of drivers' data to the US, and LinkedIn Ireland received a 310 million euro penalty that same year for behavioural advertising violations. TikTok was hit with a 530 million euro fine in 2025.
Smaller US companies should not assume they are beneath the radar. Unlike the CCPA, which includes revenue and data volume thresholds, GDPR has no size exemption. A five-person SaaS startup that targets EU users faces the same legal obligations as a Fortune 500 company.
The EU-US Data Privacy Framework and cross-border transfers
One of the thorniest issues for US companies has been transferring personal data from the EU to US servers. The GDPR restricts such transfers unless the receiving country provides an adequate level of data protection - and the US, with its patchwork of sector-specific laws and government surveillance programmes, has historically failed that test.
Two previous frameworks - Safe Harbour and Privacy Shield - were struck down by the Court of Justice of the EU in the Schrems I (2015) and Schrems II (2020) decisions. The current mechanism, the EU-US Data Privacy Framework (DPF), was adopted in July 2023 following Executive Order 14086, which introduced new safeguards around US intelligence activities.
On 3 September 2025, the EU General Court upheld the DPF in Latombe v Commission (T-553/23), a challenge brought by French MP Philippe Latombe, and confirmed that the US ensured an adequate level of protection when the decision was adopted. Only US organisations that self-certify with the Department of Commerce can receive data under it.
The stability of the DPF remains uncertain, though. Latombe appealed to the Court of Justice of the EU in October 2025, and as of October 2026 the appeal is pending. Questions also linger about the status of the Privacy and Civil Liberties Oversight Board under the current US administration. Companies relying solely on the DPF should maintain Standard Contractual Clauses as a backup transfer mechanism.
GDPR and US privacy laws: key differences
The US has no federal equivalent to GDPR. Privacy protection comes from sector-specific federal laws (HIPAA, COPPA, GLBA) and a growing list of state-level comprehensive privacy laws.
By most counts, 19 US states had enacted comprehensive consumer privacy laws by early 2026, with Kentucky, Indiana, and Rhode Island joining the list on 1 January 2026. California's CPRA remains the most expansive, but even it differs from GDPR in fundamental ways.
| Feature | GDPR | US state laws (such as the CCPA as amended by the CPRA) |
|---|---|---|
| Scope | Organisations established in the EU, or targeting people in the EU, with no size threshold | Varies by state, and most have revenue or data volume thresholds |
| Consent model | Opt-in for non-essential cookies and most data processing | Primarily opt-out: consumers must request deletion or object to sale |
| Cookie rules | Prior consent required under the ePrivacy Directive, with GDPR-standard consent | No specific cookie consent law at federal or most state levels |
| Maximum penalties | Up to 20 million euros or 4% of global annual revenue | Varies. The CCPA allows up to $2,663 per violation and $7,988 per intentional violation or violation involving minors under 16 (since 1 January 2025) |
| Private right of action | Limited, with enforcement mainly through DPAs | CCPA allows limited private action for data breaches |
| Data transfers | Restricted to adequate countries or with safeguards | Generally no restrictions on international transfers |
The CCPA amounts are adjusted for inflation every two years, and the California Privacy Protection Agency's announcement lists the current figures. The opt-in versus opt-out distinction is the single biggest practical difference. Under GDPR, your website cannot set analytics or marketing cookies for EU visitors until they actively agree in a consent banner. Under most US state laws, cookies can fire by default and users must opt out after the fact.
Practical steps for US companies
Start with a data audit: map every piece of personal data your systems collect from individuals who might be in the EU. That includes IP addresses captured by web servers, cookies set by analytics platforms, email addresses from sign-up forms, and any behavioural data from tracking pixels.
Run a cookie scan on your website to identify every cookie and tracker firing on your pages. Many US websites set dozens of third-party cookies that begin collecting data the moment a page loads. If the GDPR applies to you, every one of those non-essential cookies needs prior consent from EU visitors.
Implement a consent banner that gives EU visitors a genuine choice. The banner must let users accept or reject cookie categories with equal ease - no dark patterns, no pre-ticked boxes. Google Consent Mode v2 then passes those choices to your Google analytics and advertising tags.
Update your privacy notice to include GDPR-required disclosures: legal bases for each processing activity, data retention periods, details of international transfers, and instructions for exercising data subject rights. If you have no EU establishment and no Article 27 exemption applies, appoint an EU representative and list their contact details in the notice.
Short answers for US companies
Does GDPR apply to a US company with no European office?
It can. Under Article 3(2), GDPR applies to an organisation that offers goods or services to people in the EU or monitors their behaviour there, regardless of where the company is based. A site that is only reachable from Europe is not enough, but tracking EU visitors with advertising or analytics cookies can count as monitoring.
Can EU data protection authorities actually enforce fines against US businesses?
EU DPAs have issued billions of euros in fines against US companies including Meta, Uber, and LinkedIn. While cross-border enforcement can be complex, companies with EU customers, bank accounts, or commercial interests face real financial and operational consequences when they break the rules.
Does GDPR protect EU citizens living in the United States?
Generally no. GDPR protects individuals based on their physical location at the time of data processing, not their citizenship. An EU citizen residing in the US falls under US privacy laws for data collected while they are on American soil, unless the processing is linked to an offer or monitoring in the EU.
Is there a US federal law equivalent to GDPR?
No. The US has no comprehensive federal privacy law. Proposals like the American Privacy Rights Act (2024) have not been enacted. Instead, privacy is governed by sector-specific federal laws (HIPAA, COPPA, GLBA) and a growing patchwork of state laws, with 19 states having comprehensive privacy legislation by most counts in early 2026.
What is the EU-US Data Privacy Framework and does it replace GDPR compliance?
The DPF is a mechanism for transferring personal data from the EU to certified US organisations. It does not replace the rest of the GDPR. US companies still need to meet all GDPR requirements for processing EU personal data - the DPF only addresses the legality of the cross-border transfer itself.
Do small US businesses need to follow the GDPR?
GDPR has no revenue or size thresholds. If a small US business targets people in the EU, for example by selling to them or tracking them with analytics and advertising cookies, it falls within GDPR's scope. The obligations are identical regardless of company size.
What cookies on my US website require GDPR consent from EU visitors?
If the GDPR applies, all non-essential cookies require prior opt-in consent from EU visitors. This includes analytics cookies (such as Google Analytics), advertising and remarketing cookies, social media tracking pixels, and any third-party cookies. Only strictly necessary cookies - those essential for basic site functionality - are exempt.
Show EU visitors their own banner
If your website attracts traffic from the EU and sets cookies beyond what is strictly necessary, start by finding out what it sets. Kukie.io scans your site for cookies and trackers, sorts them into categories and uses geo-targeting to show EU visitors an opt-in banner while other visitors get the rules that apply where they are.
