Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
Example:
Would a consent form be required to adhere to GDPR in this instance, even if personalised ads are disabled for EEA/UK users?
The GDPR roughly applies in the following scenarios:
(where Europe means EU/EEA/UK as appropriate).
Art 3(1) does not seem to apply for you. Art 3(2)(a) does not apply, since you're not actively targeting people in Europe. At the point in time where you are offering the app to users, those users are in the US.
Art 3(2)(b) could apply if you collect some kind of tracking data, in particular (but not limited to) location data. But if you temporarily shut down collection of new data for personalisation while the user is in Europe, that's probably going to be reasonably safe. It might not be necessary to disable ad personalisation if that personalisation is based on data collected outside of Europe. In practice, unless your app is specifically targeted at travellers, no one will care about what your app does outside of the US.
For detailed guidelines on the territorial scope of the GDPR, consider reading EDPB guidelines 3/2018 (PDF). The document contains some relevant examples, but since it's official guidance they won't explicitly say that GDPR won't apply in a scenario like yours. The closest is Example 8:
An Australian company offers a mobile news and video content service, based on users’ preferences and interest. Users can receive daily or weekly updates. The service is offered exclusively to users located in Australia, who must provide an Australian phone number when subscribing.
An Australian subscriber of the service travels to Germany on holiday and continues using the service.
Although the Australian subscriber will be using the service while in the EU, the service is not ‘targeting’ individuals in the Union, but targets only individuals in Australia, and so the processing of personal data by the Australian company does not fall within the scope of the GDPR.
Also relevant is Example 10, which says that app downloads in the EU might not be subject to GDPR:
A U.S. citizen is travelling through Europe during his holidays. While in Europe, he downloads and uses a news app that is offered by a U.S. company. The app is exclusively directed at the U.S. market, evident by the app terms of use and the indication of US Dollar as the sole currency available for payment. The collection of the U.S. tourist's personal data via the app by the U.S. company is not subject to the GDPR.
The GDPR applies to interactions with any users who are currently inside the EU, even if they were not in the EU when the first accessed the service, or indeed the day before. If a person currently in the EU uses the service and personal information (PI) is collected or processed as a result of that interaction, there must be a lawful basis, often user consent. This is covered by GDPR article 3 on territorial scope, and GDPR article 6 on lawfulness of processing.
However, the GDPR does not apply at all if the Data Controller (DC) is outside the EU and the service does not "target" any areas in the EU (member countries or parts of member countries) and also does not "monitor behavior" of people in the EU. If the service is not advertised in the EU, and is not provided in EU languages that are not languages of the country where the DC is located, fees (if any) are collected only in non-EU currency, and efforts are made to exclude people resident in the EU, that might be sufficient evidence that people in the EU are not being targeted.
See GDPR Recital 23 for more on targeting.
If a service is targeting the EU, it may be simpler to ask for consent from all users than to try to determine who is and who is not in the EU to apply different rules.
Note also that if the DC (or the relevant establishment of the DC) is located in the EU, then the GDPR applies to all transactions and all PI processed, no matter where the data subject is located, and either consent or some other lawful basis is required.
