The EU has pretty clear rules on this in form of the Rome I regulation (reg 593/2008). In general, it allows the contractual parties to choose the law governing the contract. By default, the seller's law will apply.
However, there are more restrictions for consumer contracts. If the buyer is a consumer in the context of this contract, and the seller "by any means, directs such activities to that country or to several countries including that country", then the consumer's law applies. The parties can choose another law, but this cannot deprive the buyer from essential consumer protections in their own country's laws.
The question is then what it means to "direct activities to that country". Here, cases like C-144/09 (Hotel Alpenhof) provide clarity.
- Mere availability of a website does not by itself demonstrate any intent to target a particular country.
- However, other factors might be evidence of an intention to target customers in that country:
- mentioning that country by name, e.g. "free shipping to Germany"
- running online ad campaigns that target people in that country
- not targeting that country specifically, but targeting an international clientele
- using the language or the currency of the targeted country (e.g. accepting payment in EUR rather than CNY)
This means your hunch here is 100% correct, as far as European rules on consumer contracts are concerned:
I was under the impression (but I might be mixing it up with GDPR) that if an online seller advertises their products to customers in Germany, those laws would apply, even if the seller is outside the EU.
Having rights is different from being able to enforce them, though. For easier enforcement, it makes sense to prefer contracting with sellers that
- are established within the EU, and/or
- sell via a platform that provides a non-judicial enforcement mechanism.
You mentioned the GDPR. There is a direct connection here in that the GDPR applies to non-EU data controllers if they offer goods or services to people who are in Europe. The EDPB interprets this territorial scope to be aligned with the Rome I and Alpenhof criteria.