GDPR on Proxy Users

Question

I believe I have a good overall understanding about the GDPR legislation, in terms of what needs to be protected, etc...

My questions here are about the scope of GDPR.

Does GDPR apply to people who:

1) are EU users, but moved to USA a few years ago, and signed-up on my website?

2) went for holidays in USA, signed-up on my website, and then came back to EU?
(note - potentially skipped any Consent questions at sign-up, because IP was from USA)

3) EU users who are using a Proxy/VPN outside the EU

4) USA users who are using a Proxy/VPN in the EU

My website is mostly "anonymous", but users can set a Birthdate, Gender, Country, and can send Private Messages, Public Posts, Photos, etc... Also, things like IP and Device are logged for moderation/statistic purposes.

Answer 1

The territorial scope of the GDPR is defined in Article 3. It covers "personal data of data subjects who are in the Union", whether they are EU citizens or not. So to answer your questions:

1) are EU users, but moved to USA a few years ago, and signed-up on my website?

They are not in the EU, so are not covered. You don't need to know if someone is an EU citizen, just if they are currently in the EU.

2) went for holidays in USA, signed-up on my website, and then came back to EU? (note - potentially skipped any Consent questions at sign-up, because IP was from USA)

If someone moves into the EU while using your service then they fall under the GDPR for the time they are in the EU. If their home address is in the EU then that is covered, and monitoring of their behaviour while in the EU is also covered.

Your other two questions are about VPNs. If a VPN is used to evade IP address geolocation and you have no other clue about where someone is then you can't be blamed for not knowing where they are (although I'm not aware of any actual case law on this topic). But if someone with a USA IP address gives a home address in the EU then you should probably treat them as being in the EU to be on the safe side. Basically, if you don’t know if they are in the EU or not, you should treat them as if they were.