Do US companies need a cookie consent banner for EU traffic?

Question

Example: US website, targeting customers in the US. They use Google Analytics and Google Ads cookies etc.

Do they need a cookie consent banner for EU traffic? Or should they just not load any tracking for non-us visitors?

Answer 1

Such a banner is probably not needed, but it depends. To some degree, the questions of "tracking" and "cookies" have to be handled separately. Tracking and profiling would be regulated by the GDPR, whereas cookies and similar technologies are regulated through European national laws.

Is the US company subject to GDPR rules with regards to tracking?

Depending on context, the US company may or may not be subject to the GDPR. Per Art 3(2), it will have to comply with GDPR for those processing activities that are

• (a) related to the "offering" of goods or services to people who are in Europe, or are
• (b) related to the "monitoring" of behaviour of people who are in Europe.

Here, "offering" does not mean mere availability, it means some intention to target or market to people in Europe. Recital 23 clarifies:

the mere accessibility of the […] website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention

In their guidelines on the territorial scope of the GDPR, the EDPB has collected criteria from case law to help understand whether that targeting criterion would apply.

From your description, it seems that there would not be any targeting intention, so that GDPR wouldn't apply to the website per Art 3(2)(a).

But what about Art 3(2)(b), the monitoring criterion? There is an argument that any ad tracking/profiling from any website is subject to GDPR when it involves users who are in Europe. It could therefore be sensible to avoid enabling such tracking when visitors appear to be from abroad. For a company that does not focus on an European audience, that might not even reduce ad revenue in any noticeable way. However, this aspect of the GDPR is difficult to enforce, so many websites do not seem to bother about potential obligations through Art 3(2)(b).

Is the US company subject to European rules on cookies?

Technically, the cookie consent requirement does not come from the GDPR. It comes from the ePrivacy Directive, which is implemented as national law in each member state (and as PECR in the UK). These laws have unclear territorial scope. Within the EU/EEA, there is a country of origin principle, but that cannot help for an US company. But it would be difficult for a European court or DPA to claim jurisdiction over the activities of a foreign company unless there's some kind of European nexus, along the same lines as the Art 3(2)(a) GDPR targeting criterion.

In this answer, "Europe" means EU/EEA/UK as appropriate.