> Indications that you are specifically targeting people in Germany are if you use the German language or… How would you distinguish that from targeting people

> Indications that you are specifically targeting people in Germany are if you use the German language or… How would you distinguish that from targeting people not in Germany who happen to speak German? That is a rather large group—in the US alone an estimated ~1.2 million Americans speak German at home and might prefer a German-language site while having nothing to do with the EU. If a site is neither hosted in the EU nor operated by an EU citizen or organization then the GDPR (and all other EU law) should not apply. If an EU citizen or resident interacts with such a site they are choosing to provide whatever personal information may be collected to an entity outside EU jurisdiction of their own accord. Claiming jurisdiction over foreign entities just because they communicated with your own citizens or residents is insane. Can you imagine the outcry if this were the US (or for that matter NK) attempting to enforce their own laws—"national security letters", for example—on sites hosted in and operated from the EU?