I live in the United States. I am helping someone who just started an online store selling tee shirts. In my research to come up with a plan regarding cold call email marketing, I came across GDPR. Her target market is the US, but she is not opposed to selling to anyone in the EU either. She wants to send advertisements via email to potential customers to introduce her store. In reading about GDPR, I understand the fines can be astronomical for contacting someone who is a citizen of a country governed by GDPR. That is the scenario, here are my questions:
If her intent is to market to US based customers only and has a disclaimer on the ad, will that protect her from violating GDPR? Her disclaimer would look something like this:
"GDPR Disclaimer - This advertisement is intended to introduce potential US based customers to XYZ company...yada yada yada. If you have received this email and if you reside in a country controlled by the GDPR law, this email was not intended for you and was sent to you in error. There is nothing you have to do, you are not subscribed on any list and you will not receive any further contact".
She has obtained a list of hundreds email addresses from the internet. She has no idea who owns a given email address nor what country they reside in. Cold calling (not spamming) is allowed here in the United States. The fact that GDPR strongly discourages it (or outlaws it...not really sure which one when it comes to GDPR) should not preclude her from trying to reach potential customers in her own country. There are some domain extensions she would avoid entirely (such as "de" for Germany) as she would have the assumption any email in that domain would be for Germany and thus controlled by GDPR. Other domains are not that clear cut. The "com" domain is mainly US commercial, but "gmail.com" is a email provider which is global. How can I know if a given email address (for instance "firstname.lastname@example.org" is for a person in the United States, Europe, Australia, Japan or wherever? "jsmith" doesn't even really have to belong to someone with a first initial of "j" and a last name of "smith". It could be an alias for someone else. My point and my question is this. My friend doesn't want to violate GDPR, but at the same time she doesn't want to be precluded from marketing to potential customers in the US. How does she know if an email address is controlled by GDPR. It seems to me that there would have to be a way to know this or it cannot be enforced up to the point when it is discovered. Does this make sense? Is there any repository (online database) that would tell me is a given email address is owned by person who is in a country that is controlled by GDPR? It seems to me that there should be. She should be able to comply with the law by submitting her (say 500) list of email addresses in a query to a GDPR database and it kicking back the 20 or 30 addresses that are protected. In that way, she knows who she can market to and who she can't. As I understand it, there is no such repository so she has to guess which email addresses she can use and which she cannot. That is really unfair and it would essentially block her from reaching out to her intended audience out of fear she should send to someone in a GDPR protected country without intending to or knowing it.