Does GDPR apply to my US business?
Being visited isn’t the test.
Being aimed at is.
GDPR reaches a US business with no office in Europe only when it offers goods or services to people in the EU, or monitors their behaviour there (Article 3(2)). European visitors finding your site on their own isn’t enough. The UK has the same rule in UK GDPR. This guide shows the signals regulators look for, checks your site against them, and says what changes if the answer is yes.
This is general information, checked against the official texts on 31 October 2026. It is not legal advice; for your own case, ask a privacy lawyer.
By the Builderify team Not legal advice
Does GDPR apply to US companies?
Through two doors only.
GDPR covers a business outside the EU in two ways. If you have a real presence there, such as an office, branch or staff, it covers processing in the context of that presence. If you don’t, it covers only what you do to aim at people in the EU: offering them goods or services, or monitoring their behaviour there. Everything else stays outside, even when the people are Europeans.
There is no size threshold in Article 3, so a one-person US shop is in or out on the same test as a large one. Payment doesn’t matter either: a free service counts. And it can apply to some of your activities and not others; the EDPB looks at each processing activity separately.
“This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union.”
The person is in the EU when you offer or monitor. Nationality and residence don’t matter.
EDPB 3/2018, pp. 14–15Being reachable: a website people in Europe can open, an email address, text in English.
EDPB 3/2018, p. 18Someone using a US-only service while travelling in Europe, or a European living in the US.
EDPB 3/2018, pp. 15–16
Does GDPR apply to my business?
Check your signals.
Enter the share of your visitors from the EU and UK, then tick what is true of your business. The verdict names the signals behind it, each linked to the page of the EDPB guidelines it comes from. It is a rough guide, not a legal opinion, and nothing you enter leaves this page.
From your analytics’ country report: add up the EU countries and the UK. It shows reach, not targeting, so it moves the verdict only for tracking.
Likely in scope
What you ticked is the kind of thing the EDPB reads as aiming at people in Europe, or as having a presence there. Plan as if GDPR applies to that part of your business, and UK GDPR too if the signals point at the UK.
Possibly — get advice
One signal on its own may not show that you aim at Europe, and tracking can count as monitoring even without intent. This is the grey zone, and the place for a short call with a privacy lawyer before you decide.
Unlikely, but…
Nothing you ticked aims at Europe. Recital 23 calls the mere accessibility of a website from the EU insufficient, and a fair share of European visitors doesn’t change that by itself.
What drove it
-
Tracking that builds profiles: behavioural ads, retargeting pixels
Behavioural advertising and online tracking with cookies or fingerprinting are on the EDPB’s list of monitoring. No intent to target is needed, though the EDPB says not every online collection counts.
No signal you ticked points at Europe.
Your 12% of visitors from the EU and UK shows reach, not targeting. On its own it doesn’t bring you into GDPR (EDPB 3/2018, p. 18).
You track profiles, but with no visitors from the EU or UK there is nobody there to monitor: Article 3(2)(b) needs the person and the behaviour to be in Europe. That changes with your first European visitor.
Next steps
- 01 Work through the GDPR compliant website checklist: notice, lawful basis, processors, retention, rights and breaches.
- 02 Name a representative in the EU in writing (Article 27), and a separate one in the UK if the UK is a market, unless your processing is only occasional and low-risk. Put their details in your privacy notice.
- 03 Hold optional cookies and pixels for visitors from Europe until they say yes. The cookie banner guide sorts what needs a yes.
- 04 If European businesses will send you personal data, read the paragraph on the Data Privacy Framework.
Next steps
- 01 Decide whether Europe is a market you want. If it is, treat the answer as likely and start the GDPR checklist.
- 02 If it isn’t, make that plain on the site: prices in dollars only, delivery to the US only, and say so. The EDPB’s example of a US-only app priced in dollars fell outside GDPR.
- 03 Look at what your tracking is for. Behavioural ads and retargeting are on the EDPB’s monitoring list; plain visit counts for your own site sit at the lighter end.
- 04 Take this page’s signals, and your site, to a privacy lawyer. A rough guide can’t weigh your facts.
Next steps
- 01 Re-check whenever you add euro prices, European shipping, a translated page or an ad campaign aimed at Europe. Any of them can change the answer.
- 02 Cookies are a separate law with its own reach. The cookie banner guide covers what needs a yes, and where.
- 03 At home, US state privacy laws have their own thresholds; that is a separate question from GDPR.
A rough guide, not a legal opinion. Two or more offering signals, or a presence in Europe, read as likely; one offering signal, or profile-building tracking with European visitors, reads as possibly. The EDPB weighs factors in combination, case by case, and so should your lawyer. Rules checked 31 October 2026.
What counts as offering goods or services
to people in the EU?
Whatever shows you mean to sell to them. Recital 23 asks whether it is “apparent that the controller or processor envisages offering services to data subjects in one or more Member States”. The EDPB borrowed a list of factors from consumer-law cases to answer that, and reads them “possibly in combination with one another”.
So an order from Lyon that you fill because your checkout happened to accept it is a different thing from a French page with euro prices. Several of the factors on their own “may not amount to a clear indication”; the combination is what counts.
| Factor | On a US site, it looks like |
|---|---|
| The EU or a member state named with what you sell | “Free shipping to Germany”, “Now available in France” |
| Paid search or ad campaigns aimed at an EU country | A Google Ads campaign targeting Spain |
| An activity international by nature | Tours, travel and events people come from abroad for |
| Addresses or phone numbers for reaching you from the EU | A +44 or +49 number, a Dublin returns address |
| A top-level domain from somewhere else, or a neutral one | yourbrand.de, yourbrand.eu |
| Travel directions from EU countries | “Getting here from Paris” |
| An international clientele from EU countries | Reviews from customers in Italy and the Netherlands |
| A language or currency not usual in your own country | A German version, prices in euros |
| Delivery of goods to EU countries | EU in your shipping zones |
Not enough on its own, per Recital 23: a site people in the EU can open, an email or postal address, a phone number without an international code, or using the language of your own country.
A US news app, priced in dollars
An app “exclusively directed at the U.S. market”, with the dollar as the only currency. A US tourist uses it while travelling in Europe: GDPR doesn’t apply.
EDPB 3/2018, Example 10, p. 16An Australian service used on holiday
Offered only to people in Australia, who sign up with an Australian number. A subscriber keeps using it in Germany: still not targeting the EU.
EDPB 3/2018, Example 8, p. 15A photo-album site in four EU languages
Based outside the EU, in English, French, Dutch and German, with euro prices and delivery to France, Benelux and Germany. GDPR applies, and it must name an EU representative.
EDPB 3/2018, Example 14, p. 18
What counts as monitoring
people in the EU?
Tracking people online, especially to build a profile of them. Recital 24 asks “whether natural persons are tracked on the internet”, including later profiling “for analysing or predicting her or his personal preferences, behaviours and attitudes”. Unlike offering, monitoring needs no intent to target Europe.
“The EDPB does not consider that any online collection or analysis of personal data of individuals in the EU would automatically count as ‘monitoring’. It will be necessary to consider the controller’s purpose for processing the data and, in particular, any subsequent behavioural analysis or profiling techniques involving that data.”
EDPB 3/2018, s.2(c), p. 20On the EDPB’s list
- Behavioural advertising
- Geo-localisation, in particular for marketing
- Online tracking with cookies or fingerprinting
- Market surveys and studies based on individual profiles
From the list on p. 20, which also names CCTV and health monitoring.
Depends on the purpose
- Retargeting pixels that build audiences from your visitors
- Analytics that recognise one visitor across visits
- Personalising pages from what someone did before
Our reading: the closer it gets to a profile of a person, the closer it is to the list.
The lighter end
- Counting visits and pages for your own site, with no profile per person
- Security logs kept for a short time
Our reading of “not any online collection”. Lighter is not the same as outside.
Both conditions are needed: the person is in the EU, and the behaviour you monitor happens there (p. 19). The middle column is where the Google Analytics question usually lands, and where a lawyer earns their fee.
If GDPR applies to your US business,
what changes?
The same rules as for a European business, for the activities that are in scope, plus one duty only outsiders have: a representative. The rules themselves are in the GDPR compliant website checklist, with a checker that builds your to-do list from what your site runs.
A named contact in Europe, in writing
Where Article 3(2) applies, you designate a representative in the EU in writing. It is a person or firm established in a member state where the people you serve are, mandated to be contacted by regulators and individuals on your behalf. Law firms and consultancies offer it as a service.
- The exemption
- Processing that is “occasional”, involves no large-scale sensitive or criminal data, and is unlikely to risk people’s rights. The EDPB reads occasional as not regular and outside your normal course of business (p. 25), which a shop selling to Europe every week is not.
- Where it shows
- Its name and contact details go in your privacy notice (p. 25).
- What it doesn’t do
- Take your responsibility. You stay liable (Article 27(5)), though regulators can address orders and fines to you through the representative (p. 28).
The rule that asks before a cookie or pixel runs comes from Article 5(3) of the ePrivacy Directive, as each EU country wrote it into its own law, and from PECR regulation 6 in the UK. Their reach is set by those laws, not by GDPR Article 3, so an “unlikely” above doesn’t settle cookies. The guide to whether you need a cookie banner covers what needs a yes, and the banner how-to shows the install on each platform.
The framework is about transfers, not about whether GDPR applies to you. When someone in Europe fills in your form, the EDPB doesn’t treat that as a transfer, though GDPR still applies to you through Article 3(2) (Guidelines 05/2021, Example 1). Transfers start when a European business sends you personal data, such as a client’s customer list. US organisations under FTC or Transportation Department jurisdiction can self-certify to the framework, which gives that sender a ready legal route. As of 31 October 2026 it stands: the Commission adopted it in July 2023, the General Court upheld it on 3 September 2025, and the appeal, C-703/25 P, is pending at the Court of Justice with no judgment we could find. The Google Analytics guide follows the cases.
Does GDPR apply to US B2B companies?
To the people, not the company.
Recital 14 says GDPR doesn’t cover data about legal persons, such as a company’s name and its general contact details. But your contact at a client in Munich is a person, and their name, work email and phone number are personal data. The EDPB’s guidelines have no B2B carve-out, so the same factors apply when you market to firms in Europe: German pages, euro invoices, campaigns aimed at EU buyers.
Two cases come up often. If a European client hires you to handle its customers’ data, it must put you under an Article 28 contract, so some of GDPR’s processor duties reach you through that contract, and the transfer to you needs a route such as the framework above (EDPB 3/2018, p. 11). And the reverse: a US business that serves only the US doesn’t come into scope just because it uses a European vendor (Example 7, p. 12).
Cold email to European business addresses has its own rules, country by country; the guide to emailing customers without consent covers them.
Does UK GDPR apply to US companies?
On the same test, separately.
Yes, in the same two cases. UK GDPR Article 3(2) covers a business not established in the UK that offers goods or services to people in the UK, or monitors their behaviour there.
| For a US business | EU | UK |
|---|---|---|
| The trigger | Offering to, or monitoring, people in the EU (GDPR Art. 3(2)) | Offering to, or monitoring, people in the UK (UK GDPR Art. 3(2)) |
| Representative | In an EU member state where your people are (Art. 27) | In the UK, authorised in writing (UK GDPR Art. 27) |
| Exemption | Occasional, low-risk processing with no large-scale sensitive data | The same wording |
| Guidance on targeting | EDPB Guidelines 3/2018 | The same words in the law; the EDPB doesn’t speak for the UK, so the ICO’s view could differ |
| Cookies | Each country’s ePrivacy law | PECR |
The ICO (updated 15 January 2026) says a UK representative can be a UK-established person or firm such as a law firm or consultancy, that its details go to UK individuals, for example in your privacy notice, and are made easy for the ICO to find, and that appointing one doesn’t reduce your own liability. Its example is a sales firm in Ireland with no UK office but a UK client base. Because each article asks for someone established in its own territory, a business in scope of both needs two: one in the EU and one in the UK.
Is GDPR enforced against
businesses outside Europe?
It has been, against companies with no office in the EU. The two cases below are the ones we could check against the regulator’s own publication. Neither business is a typical small shop, so read them as proof that the rule is used, not as a measure of your risk.
Locatefamily.com
The Dutch data protection authority fined the site, which published people’s addresses and phone numbers, €525,000 for not designating an EU representative under Article 27, with a further penalty for each two weeks it went on without one. Dutch DPA
Clearview AI
The same authority fined the US facial-recognition company €30.5 million over the database of photos it built for face searches, which included people in the Netherlands, and added penalties for each breach that continued. Dutch DPA
Fines are set case by case. Article 83 caps a breach of the representative duty at €10 million or 2% of worldwide annual turnover, whichever is higher, and the most serious breaches at €20 million or 4%. Back home, US state privacy laws have their own thresholds and their own opt-out rules; that is a separate question, and the Global Privacy Control guide is a start.
See your European visitors,
and ask where the law requires it.
Builderify can’t tell you whether you target Europe; that is about your business, not your code. It can show you who comes from there and treat them the way their own law expects. It doesn’t make a business GDPR compliant, and it doesn’t claim to.
User Journey
Journey’s reports list your visitors’ countries, ranked by visitors, worked out from the IP address. Add up the EU countries and the UK and you have the share this page asks for.
User JourneyCookie Consent
This mode decides per visitor, from their device’s time zone and, where the network reports it, the country their connection comes from. Either one is enough to ask first, and a time zone that can’t be read is asked first. Europe, including the EU and UK, gets opt-in; US visitors get an opt-out.
Cookie ConsentUser Journey
With “Wait for cookie consent” on, only visitors who allow analytics get a journey of their own. Everyone else can still be counted, without a cookie or stored ID. Journeys follow one visitor across visits, the middle column in chapter 04, which is why the switch exists.
User JourneyTwo tags, in this order
Cookie Consent installs with two tags: the consent tag first in your site’s head, then the main Builderify snippet. It works on WordPress, Shopify, Wix, Squarespace, Webflow, Framer and plain HTML; the cookie banner how-to has the steps per platform.
Free to start
Every account gets 250 free credits a month, with no monthly fee; a tracked journey costs 0.1 credits, and one-time packs that never expire cover anything beyond. See pricing.
Start freeGDPR for US businesses, before you ask.
Only in two cases. If the company has an establishment in the EU, such as an office, branch or staff there, it covers processing in the context of that presence. Without one, Article 3(2) covers it only when it offers goods or services to people in the EU or monitors their behaviour there. This is general information, not legal advice.
Not because of the visits alone. Recital 23 says the mere accessibility of a website from the EU is not enough to show you are offering goods or services there. Signals such as euro prices, delivery to EU countries, pages in European languages or ads aimed at the EU are what count, and tracking that profiles visitors can count as monitoring. Cookie rules are a separate law with their own reach.
The test is the same for any size: Article 3 has no threshold for headcount or revenue, and a free service counts as much as a paid one. Being small is no exemption; what matters is whether you aim at people in the EU or track them there. A small US shop with US-only prices and shipping, and no profiling of European visitors, is usually outside. This is general information, not legal advice.
On the same test, separately. UK GDPR Article 3(2) covers a business not established in the UK that offers goods or services to people in the UK or monitors their behaviour there. If it applies, the ICO expects a UK representative, appointed in writing, unless the processing is only occasional and low-risk. A business in scope of both needs one in the EU and one in the UK.
If GDPR applies to you through Article 3(2), Article 27 asks you to designate one in writing, established in an EU country where the people you serve are, and to name it in your privacy notice. The exemption covers only occasional processing with no large-scale sensitive data that is unlikely to risk people's rights; the EDPB reads occasional as not part of your regular business. This is general information, not legal advice.
Sources
Each opened on 31 October 2026.
- legislation.gov.uk GDPR as adopted by the EU, Article 3: territorial scope
- legislation.gov.uk GDPR as adopted by the EU, Article 27: representatives
- legislation.gov.uk GDPR as adopted by the EU, Recitals 14, 23, 24 and 80
- legislation.gov.uk GDPR as adopted by the EU, Article 83: fines
- EUR-Lex Regulation (EU) 2016/679, the official EU text
- legislation.gov.uk UK GDPR, Article 3, as in force
- legislation.gov.uk UK GDPR, Article 27, as in force
- legislation.gov.uk PECR 2003, regulation 6: storage and access
- EUR-Lex ePrivacy Directive 2002/58/EC
- EDPB Guidelines 3/2018 on the territorial scope of the GDPR, version 2.1
- EDPB Guidelines 05/2021 on Article 3 and international transfers, version 2.0
- ICO Receiving personal information from the EEA: UK representatives (updated 15 January 2026)
- Dutch DPA Fine of €525,000 on Locatefamily.com (May 2021)
- Dutch DPA Fine on Clearview AI (September 2024)
- European Commission EU–US data transfers and the Data Privacy Framework
- Court of Justice of the EU General Court upholds the framework, press release 106/25 (3 September 2025)
- Data Privacy Framework How a US organisation joins the program
EUR-Lex returned an empty page to our check, so the EU GDPR wording here was read in legislation.gov.uk’s copy of the text as the EU adopted it; EUR-Lex holds the official version. The EDPB guidelines number no paragraphs, so citations give the section and page. The Dutch DPA blocked our direct fetch, so its two fines were confirmed through its own search listings and independent reports. This is general information, not legal advice. ← All guides
Stop losing the visitors
you already paid for.
More leads from the traffic you already have, and follow-up that sends itself. Free to start. No card, no monthly fee.