Does GDPR apply to US companies, and can I send one a GDPR request?

Question

Accepted Answer

Often yes. GDPR Article 3(2) covers a company with no EU establishment when it processes data of people in the EU while offering them goods or services (paid or free) or monitoring their behaviour there; the EDPB's Guidelines 3/2018 explain how targeting is judged (EU currencies, languages, shipping, marketing aimed at EU users). The test is where you are, not your passport: an American in Berlin is covered; an EU citizen in Texas generally is not. If it applies, send the same erasure, access or objection request you would send an EU company; it must answer within one month (Article 12(3)), and such a company usually must name an EU representative you can contact (Article 27). If it ignores you, complain to the data protection authority of the EU country where you live (Article 77). U.S. residents dealing with U.S. companies should use state privacy law instead, such as the CCPA. Build a request citing the right articles at https://takeitdown.agentexchange.work/request/privacy.

Does GDPR apply to US companies, and can I send one a GDPR request?

Related