Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
This is a really basic question about GDPR.
If I have products that are intended only for US customers, but can be accessed by European Union residents, does GDPR apply?
More specific example:
A customer downloads my app through the iOS US App Store, but the customer is a resident of France. Does GDPR apply?
Am I obliged to inspect the iOS locale or geo-locate or ask the customer?
I found a well-done blog post on this topic here:
https://www.socalinternetlawyer.com/territorial-scope-gdpr/
Since the GDPR text is fairly ambiguous, as this blog post notes, determination of territorial scope requires an interpretation that may be different among reasonable people - so your mileage may vary.
The most salient text of this post is this (but the whole post is worth reading):
- Is the language of an EU Member State used if it is different from the companies language?
- Does the website or app offer payment options in the currency of the EU and country in question?
- Does the website appear on a country-specific domain associated with the EU such as .uk?
- Is language on the site or app directed at an audience of a country in the EU?
- Does the company use advertising targeting an audience in the EU?
- Does the company offer customer support phone numbers to an international audience?
If a commercial website meets none of these standards and has a few incidental sales to people in the EU over the years or has a few EU-specific email address on its mailing list, it is difficult to see a court requiring GDPR compliance.
For me, with respect to my specific question, it seems that a fair extrapolation of this guidance is that GDPR applies if you expressly make your software available to any country in the EU.
For iOS, this would mean making your software available in EU App Stores - denoted by marking your app as available in an EU "territory".
But again, this is just my (non-lawyer) interpretation.
