If you serve pages to EU citizens then you run the risk of breaking the law in Austria. If the Austrian Data Protection Authority (DSB[0]) were to take you to c

If you serve pages to EU citizens then you run the risk of breaking the law in Austria. If the Austrian Data Protection Authority (DSB[0]) were to take you to court (in Austria) then you (or your company) may be prosecuted. So the question then is would the DSB attempt prosecution? If they did and you don't offer a defence then you would probably lose by default. The question then would be are you judgement proof?[1] "The extraterritorial reach of the GDPR is broadly defined. It applies to a controller or processor of data when they are monitoring the behavior of data subjects within the EU, when they are processing data related to the offering of goods or services to data subjects in the EU, or when they have an establishment in the EU and the processing of data is happening in the context of that EU establishment." [2] This is not legal advice, etc. [0] https://www.data-protection-authority.gv.at/ https://www.data-protection-authority.gv.at/ [1] https://en.wikipedia.org/wiki/Judgment_proof https://en.wikipedia.org/wiki/Judgment_proof [2] https://www.clarip.com/data-privacy/gdpr-united-states/ https://www.clarip.com/data-privacy/gdpr-united-states/