It's actually not clear that GDPR only affects EU citizens: > Here’s the issue: the law uses the term “data subject” but doesn’t define the term. Some may assu

It's actually not clear that GDPR only affects EU citizens: > Here’s the issue: the law uses the term “data subject” but doesn’t define the term. Some may assume that data subjects are EU citizens, but that analysis seems to exclude the explicit language of the law and practical considerations. There’s tourism, travel, residencies, students abroad, and much more to consider. Because GDPR uses inconsistent qualifiers when referring to data subjects and informal descriptions of who a data subject is, the public has been left with varying interpretations and significant challenges. [1] In some interpretations, a US citizen who is traveling in the EU and orders something from a US company would be considered a data subject, and the company they ordered from would need to comply with the GDPR. So how would that be enforced? Either through treaties or by requiring non-EU companies to establish a representative entity in an EU member state. [2] [1] https://kirkpatrickprice.com/blog/what-is-gdpr-personal-data-and-who-is-a-gdpr-data-subject/ https://kirkpatrickprice.com/blog/what-is-gdpr-personal-data... [2] https://politics.stackexchange.com/a/30513 https://politics.stackexchange.com/a/30513