I run a Web site. I am a natural-born US citizen. I own no property outside the US. Why does my Web site have to be GDPR compliant? Even if a European court convicts me of a crime, does it really affect me?
As of 2022, there are no legal precedents where:
- A website was operating outside the EU, with no EU legal entity established and no payments accepted from EU users
- An EU court ruled that they must still comply with GDPR because they happen to have visitors living in the EU
- Said website ignored the EU court ruling entirely, refusing to comply
- The EU managed to convince the authorities of the country where the website is located to enforce the judgement on their behalf
See As of 2020, have any GDPR-related court judgements been successfully enforced on companies without presence in the EU? for a prior discussion of this question.
So as of today, you're likely fine not complying with GDPR as long as you don't take any payments from users in the EU and don't have a legal entity there. Things might change in the future if a successful foreign enforcement occurs, but until then it's highly likely you'll be just fine. While EU authorities would love to force the whole world to comply with their laws, in reality its unclear if this is possible, as otherwise every single website would face a huge headache trying to comply with laws from Turkmenistan or Iran despite not taking any payments from these nations.
As stated by GDPR article 3 you are required to follow it under the following circumstance:
This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:
- the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or
- the monitoring of their behaviour as far as their behaviour takes place within the Union.
You can read the recourse better at What is the legal mechanism by which the GDPR might apply to a business with no presence in the EU?, but in short the US will allow the EU court to press it's rulings due to wanting to keep its trades, treaties and other similar things in place.