4

This is a really basic question about GDPR.

If I have products that are intended only for US customers, but can be accessed by European Union residents, does GDPR apply?

More specific example:

A customer downloads my app through the iOS US App Store, but the customer is a resident of France. Does GDPR apply?

Am I obliged to inspect the iOS locale or geo-locate or ask the customer?

  • Considering a "user" can change citizenship during their lifetime, or pass on the handling of their data after their death to someone of a different citizenship, also considering the internet is global and anyone can more or less access information anywhere, or lend their iPhone to their friends to let them use the app, I'd make everything GDPR compliant, all the time. It's basically guidelines everyone should follow anyways – MicroMachine Apr 18 '18 at 17:42
1

I found a well-done blog post on this topic here:

https://www.socalinternetlawyer.com/territorial-scope-gdpr/

Since the GDPR text is fairly ambiguous, as this blog post notes, determination of territorial scope requires an interpretation that may be different among reasonable people - so your mileage may vary.

The most salient text of this post is this (but the whole post is worth reading):

  • Is the language of an EU Member State used if it is different from the companies language?
  • Does the website or app offer payment options in the currency of the EU and country in question?
  • Does the website appear on a country-specific domain associated with the EU such as .uk?
  • Is language on the site or app directed at an audience of a country in the EU?
  • Does the company use advertising targeting an audience in the EU?
  • Does the company offer customer support phone numbers to an international audience?

If a commercial website meets none of these standards and has a few incidental sales to people in the EU over the years or has a few EU-specific email address on its mailing list, it is difficult to see a court requiring GDPR compliance.

For me, with respect to my specific question, it seems that a fair extrapolation of this guidance is that GDPR applies if you expressly make your software available to any country in the EU.

For iOS, this would mean making your software available in EU App Stores - denoted by marking your app as available in an EU "territory".

But again, this is just my (non-lawyer) interpretation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.