4 ms·

It means nothing for you. There is no legal risk whatsoever. Not in the US, and neither in Europe or Austria if you were to travel there. For GDPR to apply, yo

It means nothing for you. There is no legal risk whatsoever. Not in the US, and neither in Europe or Austria if you were to travel there. For GDPR to apply, your website needs some connection to an EU country beyond just being on the internet. What constitutes such a connection isn't an exact science, obviously, which leads and/or allows people to make rather strange claims, the worst of which is probably that such ambiguity makes it entirely impossible to make laws on the subject. The "official example" is explicitly making accommodations to sell to customers in the EU. The marginal example on the non-GDPR side of the dividing line is a US website, in English, that does sell to EU customers, but only if they sneak their country into the generic second line of the address form. What gets you to the other side of the line is, for example, a drop-down that lets you chose an EU country for delivery, a switch that allows users to chose to read your website in German (but not Portuguese b/c Brasil), etc. While there are plenty of cases, as always in life, that straddle the border, one thing is and always was clear: your English-language blog does not fall under GDPR.

whakim 5y ago
Yeah, this is exactly correct and in line with the legal advice I received when working with GDPR-related features at a previous job. The relevant text is Article 3 of the GDPR ("Territorial Scope"), and if you're not located in the EU and not clearly intending to offer goods and services to EU data subjects, then you're in the clear.
- XCSme 5y ago
  But then isn't Google violating GDPR? Because they do provide goods and services to the EU. Or is the US Google a different company than the one that provides goods in the EU?
  - whakim 5y ago
    In this particular case, Google is considered the "data processor" (as opposed to GP's blog, which is the "data controller"). Google is certainly subject to the GDPR as a data processor in this case. That being said, the EDBP is clear in their guidelines that using a data processor established in the EU does not itself make the controller subject to the GDPR.

whakim 5y ago

Yeah, this is exactly correct and in line with the legal advice I received when working with GDPR-related features at a previous job. The relevant text is Article 3 of the GDPR ("Territorial Scope"), and if you're not located in the EU and not clearly intending to offer goods and services to EU data subjects, then you're in the clear.

XCSme 5y ago
But then isn't Google violating GDPR? Because they do provide goods and services to the EU. Or is the US Google a different company than the one that provides goods in the EU?
- whakim 5y ago
  In this particular case, Google is considered the "data processor" (as opposed to GP's blog, which is the "data controller"). Google is certainly subject to the GDPR as a data processor in this case. That being said, the EDBP is clear in their guidelines that using a data processor established in the EU does not itself make the controller subject to the GDPR.