> This is something I've been curious about for a while. GDPR, IIUC, makes an EU law apply to things that happen inside the US (for example, EU person flies to

> This is something I've been curious about for a while. GDPR, IIUC, makes an EU law apply to things that happen inside the US (for example, EU person flies to the US and uses Facebook on US-housed servers with data stored in the US, GDPR apparently considers that in-scope for the law). That's a common myth. The GDPR doesn't follow citizenship, even if a lot of unofficial guidance wrongly says that. US-based businesses that aren't branches of companies established in the EU, not targeting people in the EU, and not profiling or otherwise monitoring the behavior of people in the EU are not subject to the GDPR. And "in the EU" cares about where the person's body is, not who issued their passport. This European Commission summary of GDPR's Article 3 (Territorial scope) is informative: https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations/application-regulation/who-does-data-protection-law-apply_en https://commission.europa.eu/law/law-topic/data-protection/r... Here is Article 3 itself: https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/ (unofficial site but generally accurate) And guidelines (PDF) about Article 3 from the European Data Protection Board: https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_3_2018_territorial_scope_after_public_consultation_en_1.pdf https://www.edpb.europa.eu/sites/default/files/files/file1/e... However, your scenario may fall in-scope of the GDPR for a simple reason: the Meta Terms of Service specify that the data controller for users (and non-users) living in the EU is Meta Platforms Ireland Limited, which is a company established in the EU. When the data processor or controller activities are through a company or branch established in the EU, the GDPR applies no matter where in the world the person and the data are.