The GDPR's territorial scope is the set of rules in Article 3 that decide when the regulation applies, wherever a company is based. It applies to a website outside the EU in two cases: when the business has an establishment in the EU, or when it targets people in the EU by offering them goods or services or by monitoring their behaviour there. A site that people in Europe can merely reach is not caught by that alone. A non-EU business caught by the targeting test usually has to appoint a representative in the EU under Article 27.
The global reach of European privacy law
The General Data Protection Regulation (GDPR) does not stop at the geographical borders of the European Union. A website hosted in Canada, a software platform operated from Australia, or an e-commerce store based in the United States can all fall under European privacy law. The determining factor is not where a company registers its headquarters, but whose personal data it processes and how it interacts with individuals located in the EU.
The territorial scope of the GDPR is defined in Article 3 of the GDPR, which sets two distinct criteria for application.
Article 3(1) sets out the establishment criterion. It applies the regulation to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not. If a business operates a branch, a subsidiary, or even a single employee working there as a stable arrangement, the processing connected to that establishment falls under European law. The legal form of the arrangement does not decide the outcome: regulators look at the effective and real exercise of activity.
A foreign company cannot avoid the law by keeping its servers overseas while running a sales office in Paris. The European Data Protection Board (EDPB) confirms that the presence of a single representative can be enough for an establishment if that representative carries out a real and effective activity.
The extraterritorial effect: the targeting criterion
Article 3(2) introduces the targeting criterion, which gives the GDPR its extraterritorial reach. It applies the regulation to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, when the processing relates to one of two activities: offering goods or services to those individuals, or monitoring their behaviour as far as it takes place within the Union.
The EDPB published Guidelines 3/2018 on territorial scope to explain how national authorities should read these rules. Citizenship and legal residence do not matter to the test, but targeting always does: the EDPB stresses that processing the data of someone in the Union is not, on its own, enough to bring a non-EU business into scope.
The EDPB's own example is a US news app aimed only at the US market and priced in US dollars. When a US citizen uses it on holiday in Europe, that data collection is not subject to the GDPR. A French citizen browsing a website from their home in New York is not protected by the GDPR either, unless the processing is linked to an offer or monitoring directed at people in the EU.
The distinction between active targeting and passive availability is the core of the test. A website that displays text to anyone who finds it is in a different position from a site that deploys third-party tracking scripts to build advertising profiles of its European visitors.
Article 3 and Article 27 for a website outside the EU
Defining the offer of goods or services
Operating a website that can be accessed from Europe does not automatically trigger the GDPR. Recital 23 and the EDPB guidelines state that mere accessibility is not enough to show an intention to target EU individuals.
A local bakery in Toronto with a website that happens to be visible in Berlin is not subject to European data protection law. The legal test asks whether the controller envisages offering goods or services to data subjects in one or more member states, so regulators look for signals that you are trying to attract European visitors or customers.
These signals include offering shipping to EU countries, displaying prices in euros or another EU member state's currency, or providing customer service numbers with EU country codes. Prices in pounds sterling point to the UK, which has its own UK GDPR since it left the EU.
Using a top-level domain specific to an EU country, such as .de or .fr, is a strong indicator of targeting. Running advertising campaigns aimed at users in specific European cities also meets the criterion under Article 3(2)(a). Free services are caught too: a free app or tool that actively encourages European users to sign up falls under the same obligations as a paid subscription service.
The intention to engage with the European market decides the outcome. If you deliberately court a European audience, you take on the obligations that come with that market.
Monitoring behaviour: how cookies can trigger the GDPR
The second part of the targeting criterion, in Article 3(2)(b), is the one most non-EU websites need to check. The GDPR applies if your website monitors the behaviour of data subjects as far as their behaviour takes place within the Union. Cookies and tracking pixels are the usual technical means of online behavioural monitoring.
When a visitor from Rome lands on your US-based blog, and your website deploys Google Analytics 4 (_ga) or the Meta Pixel (_fbp) to track their page views and click paths, the EDPB says that can be monitoring. It lists behavioural advertising, geo-localisation for marketing, and online tracking through cookies among the activities that may count. Monitoring implies "a specific purpose in mind" for collecting and reusing the data, and the EDPB does not treat every online collection of data about people in the EU as monitoring.
So a purely informational blog based in Canada that tracks and profiles European visitors, for example for behavioural advertising, can fall under Article 3(2)(b) even if it sells nothing in Europe. Whether a simple visit counter with no profiling amounts to monitoring is less clear, because the EDPB ties monitoring to the purpose of the processing.
The data collected - including IP addresses, device identifiers and browsing history - is personal data under European law. Where the GDPR and the ePrivacy rules apply, you need valid, prior consent before deploying these tracking scripts to visitors in the European Economic Area, just as a website hosted in Brussels, Paris or Berlin does. Pre-ticked boxes or implied consent through continued browsing do not meet the standard for valid consent under Article 4(11) of the GDPR.
The Article 27 requirement: appointing an EU representative
Non-EU companies that fall under Article 3(2) face an additional, often overlooked obligation. Article 27 of the GDPR requires them to designate in writing a representative established in one of the member states where the data subjects whose data they process are located.
The EU representative is a local point of contact for data subjects and supervisory authorities. If the French CNIL or the Irish Data Protection Commission needs to investigate a data breach or a complaint about your website, it will direct its correspondence to your representative, so regulators do not have to go through international channels to ask a question.
Exemptions to this rule are narrow. You can only avoid appointing a representative if your processing is occasional, does not include large-scale processing of special categories of data (such as health or biometric data) or of data about criminal convictions, and is unlikely to result in a risk to people's rights and freedoms. The EDPB reads "occasional" as not carried out regularly, so most websites engaging in systematic tracking, behavioural advertising or regular e-commerce with people in the EU will not qualify. A typical online retailer tracking thousands of European visitors a month is well beyond occasional processing.
Failing to appoint a representative is a violation on its own. On 12 May 2021, the Dutch Data Protection Authority fined Locatefamily.com €525,000 because it had no representative in the EU, which made it hard for people to have their addresses and phone numbers removed. The authority also imposed an order subject to a penalty of €20,000 for every two weeks without a representative. No separate data breach was needed for the fine.
Enforcement against foreign companies
A common misconception outside Europe is that EU regulators cannot enforce fines across borders. Recent actions show that data protection authorities do pursue foreign entities.
Under Article 83(5) of the GDPR, maximum fines can reach €20 million or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher. These ceilings apply to non-EU businesses caught by Article 3 just as they apply to European ones.
In May 2025, the Irish Data Protection Commission fined TikTok €530 million over transfers of EEA users' data to China, which could be accessed from there without adequate safeguards. Two years earlier, the largest GDPR fine to date - €1.2 billion against Meta in 2023 - also concerned transfers of EU users' data, in that case to the United States.
Collecting a fine from a company with no assets in the EU can be difficult for a regulator. The commercial consequences are harder to escape: a company with EU customers, payment providers or advertising partners depends on business in a market where the decision applies.
Understanding international data transfers
When a website outside the EU processes the data of European visitors, the GDPR's rules on international data transfers (Chapter V) also come into play. The EDPB published Guidelines 05/2021 to clarify the interplay between Article 3 and the rules on transfers.
A transfer occurs when a controller or processor subject to the GDPR discloses personal data to an importer located in a third country. This holds regardless of whether the importer is itself subject to the GDPR through Article 3(2).
If your US-based e-commerce platform collects data directly from a European customer, that direct collection from the data subject is not a transfer under Chapter V. However, if your US company then passes the data to another processor located in India or Brazil, that onward movement is an international transfer. You must protect it with appropriate safeguards, such as Standard Contractual Clauses (SCCs), so the data keeps its European level of protection.
Map every data flow before you pass European data to third-party vendors.
Putting it into practice for a non-EU website
If the GDPR applies to your website, the first thing to get right is your cookie consent. If you use analytics, advertising trackers or profiling tools, you must hold these scripts back before they run in a European visitor's browser.
Geolocation plays a vital role here. You do not need to show a GDPR-style opt-in banner to visitors from California or Japan if their local laws do not require it. However, when a visitor from Germany or France opens your site, your banner needs to detect their location, appear, and keep all non-essential cookies blocked until the visitor actively consents.
Your privacy policy must also reflect your obligations. It needs to state what data you collect, why you collect it, how long you keep it and who you share it with. It must also set out the rights of people in the EU under Chapter III of the GDPR, including access, rectification, erasure and data portability. If Article 27 applies, list the contact details of your EU representative.
Treat this as ongoing work rather than a one-time setup, because the scripts on a website change whenever a plugin, tag or campaign does.
Questions about the GDPR's territorial scope
Does the GDPR apply to US companies?
It can. The GDPR applies to US companies that have an establishment in the EU, offer goods or services to people in the EU, or monitor the behaviour of people in the EU, for example with tracking cookies used for profiling or behavioural advertising. A website that people in Europe can merely reach is not enough on its own.
Do I need a cookie banner if my website is not in Europe?
You need a consent banner for European visitors if your website is caught by Article 3 of the GDPR, for example because you track and profile their behaviour with analytics or advertising cookies. Under the ePrivacy rules, those cookies need consent before they are set.
What happens if a non-EU company ignores the GDPR?
Non-EU companies within the GDPR's scope face the same fines as EU companies, up to €20 million or 4% of worldwide annual turnover. The Dutch Data Protection Authority fined Locatefamily.com €525,000 in 2021 just for not appointing an EU representative.
What is an EU representative under Article 27?
An EU representative is a person or organisation established in an EU member state, designated in writing by a non-EU company that falls under Article 3(2). It acts as a local point of contact for data subjects and supervisory authorities.
Does an Australian app with EU users need an EU GDPR representative?
Usually, yes. If the app is offered to people in the EU or monitors their behaviour, Article 3(2) applies and Article 27 requires a representative in an EU member state. The only exception is processing that is occasional, involves no large-scale special category or criminal data, and is unlikely to result in a risk, which rarely fits an app with regular EU users.
Does the GDPR protect EU citizens living abroad?
Generally no. The GDPR's targeting test protects individuals who are in the European Union when their data is processed, regardless of their nationality. An EU citizen living abroad is covered only where the processing is linked to an offer or monitoring directed at people in the EU, or the business has an EU establishment.
Can I use IP addresses to show GDPR banners only in Europe?
Yes. Many websites use IP-based geolocation to show an opt-in consent banner only to visitors in the European Economic Area and different rules elsewhere. Make sure the detection fails safe, for example by showing the stricter banner when a location cannot be determined.
Show European visitors the banner the GDPR expects
If you run a website outside the EU but attract European visitors, start by knowing what your pages set. Kukie.io's scanner finds first-party and third-party cookies across your site and sorts them into categories, and its geo-targeting shows an opt-in banner to visitors in the EEA while other visitors get the rules that apply where they are.
