I've heard from fairly reliable sources that you can't avoid GDPR by using your website's terms of service as way to circumvent that law. From what I have seen online, if your website serves European users, it must obey that law. However, if a website is based in the US and the terms of service say that the law governing the terms is US law, how can GDPR have any affect? I'm not a lawyer, but I've signed many contracts in my life and nearly all of them have some form of "governing law" clause.
4Possible duplicate of What is the legal mechanism by which the GDPR might apply to a business with no presence in the EU?– BlueDogRanchApr 22, 2019 at 15:09
6In my view, while related, this is not a duplicate. This asks specifically about a TOS provision and a Governing law clause, neither of which is mentioned in the other Q or its answers.– David SiegelApr 22, 2019 at 15:32
However, if a website is based in the US and the terms of service say that the law governing the terms is US law, how can GDPR have any affect?
It is unlikely that the EU will be able to enforce financial penalties against a company with no presence in the EU. But they could for example block your website in the EU, depriving you of your EU user base. The actual measures that they could or would take against such a company are still unclear, since the GDPR is quite new, and there has been no action under the GDPR against foreign companies.
I'm not a lawyer, but I've signed many contracts in my life and nearly all of them have some form of "governing law" clause.
The governing law clause in a contract identifies the law that will be used to interpret the contract and to resolve any disputes arising from the contract. The law identified in the clause does not become the sole law governing every aspect of the relationship between the parties, however.
For example, a business in New Jersey could have a contract with a client in New York with a clause specifying New Jersey law as the governing law of the contract. But that does not mean that New York's consumer protection law doesn't apply to the transaction.
3If the EU blocked me, my answer is "good riddance!"– JoshuaApr 22, 2019 at 16:05
6@Joshua In that case perhaps you should consider refusing to display your site to users in the EU.– phoogApr 22, 2019 at 16:11
12@Joshua That's not an attitude a for-profit business can usually take. The EU is probably a source of enormous revenue.– BarmarApr 22, 2019 at 16:29
10The better response would be to figure out why GDPR exists and make your site more customer friendly by conforming to it. Apr 22, 2019 at 16:55
3The EU can definitely enforce fines against US based companies- US courts can and do enforce EU judgements and vice-versa– Dale M ♦Apr 23, 2019 at 0:31
What you are asking for is, in effect, an "opt out" clause. It might be framed in terms of choice of governing law, but effectively it seeks to opt you out of EU consumer protection laws.
Not surprisingly, most consumer laws just don't allow you to do that.
Otherwise a car seller would simply write onto their contract "If this car has a fault that kills anyone, you agree to hold the seller and maker harmless and not to claim damages for any reason", and similar for anything else - your unsafe or unreliable toaster, your bank transfer that's sent to the wrong place, your "unbreakable" phone that broke the first time you carried it, your unexpected exit charges on a loan or phone contract, and so on.
So consumer protection law generally doesn't permit opting out. (Much the same way as a lot of employment law, you can't just opt out of by putting it in the contract.)
If you flip it around and hypothetically suppose there was a US law and an EU website wanted an opt out, you can see why it wouldn't be fair or work well also. It that were to be legally permitted, one of 2 things may tend to happen - either
- many other websites seeking to deprive US citizens of the benefit they would get from that law, would just move overseas and also avoid giving the benefit to US users (and under market pressure others may feel they have to do likewise to compete), or
- we end up with a situation where equal US citizens are protected unequally depending on how canny their retailer is, in their hosting.
You can imagine that wouldn't be ideal either way.
But really, its worth understanding why that law is there. After all, its for reasons that affect citizens worldwide.
There has been enough in the press recently, as well as commonsense understandings, to appreciate the possible negative impact on private citizens if their data is mishandled - and that far too often it has been mishandled. Citizens trust you with their data when they visit your site. The GDPR makes clear what current standard of protection and rights they should be able to take for granted without needing to check each website's T&Cs.
Also be aware that in at least some jurisdictions (the UK is one, at least, not sure about other EU countries or US states), there is a law about unfair contract terms to consider as well. The UK version of that law, which is the only one I know well enough to describe, says that if a supplier of tangible goods or of a service, has a standardised contract, and the consumer has to "take it or leave it", then the consumer can ask a court to strike out any term in it on the grounds it is an unfair contract term, essentially one where they had to accept it even though it's unfair and unreasonable, and if the court agrees, the term is replaced (if possible) with a similar but fair term, or (if not) it is struck out. This law isn't actually used very often, but is a very powerful one for addressing unequal bargaining power - think in terms of "whatever Microsoft might put in the Windows T&C" or a rogue payday lender's unfair repayments/interest, or similar. I know the argument that "they don't have to use it if they don't like it", but the reality is some will, and that's enough for an unfair business to profit from; so the law is what it is. A term that forced a person using your terms, to give up their rights as a cost of using the site within its "small print" could well find the clause struck out anyway, although in practice such cases are pretty uncommon.
Imagine you export some goods to Ireland, and you put on the shrink wrap that the governing law of the goods is that of the US (or rather a specific legal country within the US). Your goods are illegal in Ireland because they don't meet Irish and EU safety standards.
Do you get to opt out of Irish law by your shrinkwrap? If not, how is this different from trying to opt your website out of GDPR?
1But what if it's not targeted at EU users, but just any user on the web? It seems a little unfair to expect the site owners to block access to each country/region that might have different laws. For example, what if Zimbabwe implements special internet laws for its citizens?– JimApr 22, 2019 at 20:43
This is a fairly good example. The counterpoint might be "I ship anywhere on money orders. I don't know if the goods are lawful in your area or not." Let others argue whether this is lawful or not. I would normally argue on the not side.– JoshuaApr 22, 2019 at 20:55
@Joshua Right but then you still did the shipping. Maybe Ireland has to figure out how to catch you, but you can't choice of law your way out of them maybe wanting to catch you (unless their law lets you do just that, of course).– MarcinApr 22, 2019 at 21:48
2@Jim - if you sell a product in 10 countries (or even give a product away for free), you would hardly be surprised if you have to comply with the law of each country when you sell products there. Providing services is no different, and an online service or website is still a service. If you configure your website to allow purchases or consumer usage from 10 countries, you can hardly be surprised when those 10 countries expect their law to be applied to consumers in their territory. (Stark examples: should a country freely allow websites for child brides or copyright-piracy ...– StilezApr 23, 2019 at 7:59
1... or fraudulently deceptive claims within its territory, as long as the website gets hosted somewhere those are legal or accepted? Of course not.) It's the website owner's choice where to market to/publish in, and to research the places they want to market to/publish in. They always have the option not to market to, or allow visitors from, places where they don't feel comfortable they can comply with the law, or where the effort required isn't worth it to them.– StilezApr 23, 2019 at 8:03