Within the EU would be the safest bet. That being said, GDPR isn't purely a data localization law - that's merely an implication of broader data export rules.

Within the EU would be the safest bet. That being said, GDPR isn't purely a data localization law - that's merely an implication of broader data export rules. If a court were to interpret public posts as private information under GDPR, then the solution would be that the user in America doesn't even see the post, because retrieval would count as a data export. However, I'm not sure if this interpretation would fly in court. Most of the Schrems II cases focus around analytics, CDNs, and ad-tracking - i.e. the sort of things that just happen automatically and users don't get a say in[0]. Presumably, if a French user wanted to DM an American[1], whatever data transfers are necessary to send that message along would be legal, but nothing further. So we wouldn't be banning Americans off of Facebook, but Facebook couldn't use US/EU messaging as an excuse to ignore GDPR entirely. GDPR data export rules are not specifically targeted at Americans. They apply to all third countries, America just being one of them. If you pass GDPR in your local law, then unlimited data exports are permitted[4]. However, that would probably require you also have the same data export rules, which would also mean you can't export data to other third countries that don't have them. Furthermore, while I postulated scenarios in which a data export would be necessary in order for the service to work at all, you probably couldn't use those justifications to ship data to arbitrary non-GDPR third-countries. i.e. DMs can flow between America and the EU, but the CDNs probably need to remain in the GDPR-o-sphere or America. That being said, there is the potential for further legal hijinx. If the US absolutely insisted on "privacy is for US citizens only"[2], they could pass contradictory privacy rules that made compliance with GDPR illegal. This would cut the Internet[3] in half, and make it illegal to offer any sort of service in which Americans and Europeans interact. And the US is the king of making economic sanctions watertight - it's our primary engine of soft imperialism. We don't roll tanks, we just make it very painful for any country to trade with you. [0] Unless you maintain a really, really victim-blamey definition of the word "User-Agent" [1] Despite France's stereotypical anglohostility, such people do exist! [2] This is the current operating mode of most intelligence agencies and trade representatives. Internationalism without international citizenship is a recipe for the erosion of democracy. [3] Or, at least, the Internet of countries that don't have restrictive national censorship policies [4] In your specific example, the EU Commission ruled that Japan's data protection law is adequate... but it's not entirely GDPR. And the EU Commission are the same people who thought US Privacy Shield was OK. So at this point I'm going to say get a bunch of lawyers if you really need to know the answer to the question of "can I export data here".