GDPR protection for non-EU individuals by using EU services through VPN use?

Question

REASON FOR QUESTION:

I was born in the EU and lost my citizenship when I immigrated to the US many years ago. As many know, our privacy protections are a joke and our data gets collected and sold to the highest bidder with almost no controls.

Anonymous accounts and using a US VOIP number provided by an EU company used to be a good enoufh defense, but lately there is an online trend positively identify customers by requiring a mobile number (meaning that unscrupulous companies can track every movement you make) and rejecting VOIP numbers. This is obviously disturbing, especially with the evolution of AI and thus the possibility to profile and know an individual better than he knows himself. I have no problem with a government agency of a trustworthy country having access to my data AFTER getting a warrant if there is a justified reason, but I certainly do not want private companies to have access to it.

So I thought that I might be able to obtain GDPR privacy protection by using a VPN to move my point of online presence to the EU and doing most of my online business and activity through EU-based services. For example, if I use google or youtube through a local US address my history and activity can be sold, but if I do it through the VPN to do it through their EU servers... my data would be protected from sale due to GDPR.

RESEARCH DONE:

From what I researched, companies based and providing service in Europe are required to follow GDPR privacy rules.

Sure, they can easily do the common international trick of establishing local companies in each company and "franchising" their brand so that they appear global while "legally" being independent companies in each country.

But... so long as I get my services in the EU (through a VPN that establishes my presence there and thus ensures I interact with EU servers) it seems that I would be protected by GDPR.

QUESTION:
Am I right in thinking that using a VPN server in the EU would get me GDPR privacy protections?

IMPLICATIONS: If the answer is yes, this could move a lot of personal-privacy-concerned customer electronic business from the US to the EU and if enough people do it even prompt the US to finally pass laws that put consumer privacy ahead of corporate profits.

Answer 1

Kinda but not really.

As a rough approximation, GDPR applies when in a controller–subject relationship, at least one of them is in Europe:

• GDPR applies per Art 3(1) to all processing activities that occur in the context of an European establishment.
• For non-European data controllers, GDPR applies per Art 3(2) to those processing activities that relate to the offering of goods or services to people who are to Europe, i.e. services that are marketed to Europeans.

Citizenship is explicitly not a factor here.

If you're interacting with European companies (not via non-European intermediaries), then you're covered by GDPR regardless of whether you use a VPN.

If you're interacting with non-European companies but consume their Europe-oriented services, for example by pretending to have an European network location, then things are tricky. You'd clearly be covered by GDPR if you were physically in Europe, for example during a tourist trip. It is likely that websites would treat you as GDPR-covered. However, you might run into practical difficulties if you'd try to enforce your rights. In particular, I think that no data protection authority would be responsible for your case, and no European court would have jurisdiction.

If you're interacting with non-European companies that don't explicitly offer their services to an European market, GDPR will likely not apply at all, regardless of where you are or where you purport to be.

In this answer, "Europe" means EU/EEA/UK as appropriate.

Personal opinion: using a VPN like this might or might not work, but it is unlikely to make things worse privacy-wise. So you might as well try. But you shouldn't rely on this as legal protection. Also, note that many companies should comply with privacy rules, but don't.