How can you block GDPR users from US based sites?
<p>(I originally asked this question on Server Fault with GDPR tag, but due to minimal response was advised to try asking here)</p>
<p>As I understand it, GDPR is European legislation promoted as protecting EU citizen's privacy and granting EU citizens rights to control how websites use data/whether the websites can store said data.</p>
<p>My initial impression of GDPR is that if an EU citizen wants GDPR rights, they should only use servers residing in the EU which would be subject to GDPR legislation.</p>
<p>However, there apparently is some notion that EU legislation can somehow affect servers outside of the EU? I'm not a lawyer, but I would expect that each nation defines and enforces their own laws -- which may or may not be in alignment with another nation's legislation. How is GDPR even applicable to servers residing in the US (or any other non-EU nation)?</p>
<p>Based on several articles I've read online, it seems somehow the US allows EU's GDPR legislation to be enforced on US soil.</p>
<p>Since I don't want to deal with GDPR headaches, I seemingly have no choice but to block ALL EU citizens (and anyone else accessing my sites/services from within the EU) from using my websites and services. I can firewall the entire EU IP address space to catch the bulk of EU users, but there are EU citizens who could use VPN or otherwise access my site from an non-EU ISP.</p>
<p>Is there a legal approach that can be used to block EU citizens? E.g. &quot;Accessing this site or service as an EU resident is illegal&quot; such that if one violated the legal directive, GDPR expectation would be void? I don't care if they use my websites and services as long as they understand I'm not playing the GDPR game and anything they submit to my servers won't be subject to it.</p>

<p>This might be based on a misunderstanding of the GDPR. The GDPR applies under three circumstances:</p>
<ul>
<li>Art 3(1): you (the data controller) are established/live in the EU.</li>
<li>Art 3(2)(a): you offer goods or services to people in the EU.</li>
<li>Art 3(2)(b): you monitor behaviour of people who are physically in the EU.</li>
</ul>
<p>What is not a factor:</p>
<ul>
<li>what citizenship your site visitors have (see Recital 14).</li>
<li>whether your site can be accessed from the EU (see Recital 23).</li>
</ul>
<p>The crucial part is what “offering of goods or services” means. The EDPB has issued official guidelines on the interpretation of this <em>targeting criterion</em> (<a href="https://edpb.europa.eu/our-work-tools/our-documents/riktlinjer/guidelines-32018-territorial-scope-gdpr-article-3-version_en" rel="nofollow noreferrer">guidelines 03/2018 on the territorial scope of the GDPR</a>). Some important notes:</p>
<ul>
<li>The offer of goods or services does not have to involve any compensation. Gratis access to a website can also be a service.</li>
<li>GDPR applies when targeting people currently in the EU. US tourists in the EU are protected, EU tourists in the US are not.</li>
<li>The moment of offering the service matters. E.g. a US person using an US service cannot claim GDPR protection against the US service while travelling to the EU.</li>
<li>Instead of looking at the users of the service, we should look at the target market of the service: if the service doesn't cater to people in the EU, GDPR doesn't apply.</li>
<li>The essential question is whether the provider of the service “envisages” offering services to people in the EU. Does the service provider intend for EU data subjects to use the service?</li>
<li>The guidelines assemble a non-exhaustive list of indications from case law, in particular the <a href="https://en.wikipedia.org/wiki/Pammer_and_Alpenhof_cases" rel="nofollow noreferrer">Pammer and Alpenhof case</a>. An excerpt of indications that GDPR might apply:
<ul>
<li>the EU or member states are mentioned in the offer of services</li>
<li>the website has marketing targetted at an EU audience</li>
<li>the activity at issue is of international nature, e.g. tourism</li>
<li>mentioning special contact details for the EU market</li>
<li>using a top-level domain name associated with the EU or member states</li>
<li>travel instructions when visiting from the EU</li>
<li>mentions of an international clientele including people/companies from the EU</li>
<li>use of a language or currency other than yours</li>
<li>offering delivery of goods to the EU</li>
</ul>
</li>
</ul>
<p>So whether GDPR applies would depend on the subject matter of your website, and on whether you intend to participate in the EU market (even if only online, even if your service is gratis).</p>
<p>If GDPR were to apply, then blocking people from the EU would be questionable. It might also be illegal, but not on GDPR grounds.</p>
<p>If GDPR does not apply, then blocking people from the EU is already unnecessary.</p>
<p>However, geoblocking would be a very strong indication that you don't intend to offer your services to people in the EU. There is no good case law on whether geoblocking is necessary or sufficient. I assume that geoblocking is sufficient (even if it can be easily circumvented e.g. with a VPN), but that it's not necessary in the first place.</p>
<p>You could also re-emphasize that you're not targeting the EU market when considering the above indications. E.g. a web shop might clarify that they only ship to North America, but not internationally.</p>
<p>Again: your targeting of your website is the crucial factor, not the origin of your visitors. So even if there is an occasional EU visitor, that doesn't mean you have to comply with GDPR.</p>

<h2>You can’t</h2>
<p>First, California has a law very similar to the GDPR that applies to its residents no matter where they are. This is different from the GDPR which applies to all people in the EU no matter where they reside. So, a Californian resident in Europe is covered by both laws and a German in Nebraska is covered by neither.</p>
<p>Second, some laws allow parties to agree to abide by different rules, for example, arbitration laws allow parties to give up their right to use the courts. Others don’t, for example, you can’t agree in a contract that it’s ok to drive through red lights. The GDPR (and the California law) are explicit that you can’t contract out, any attempt to do so is simply void (of no effect) and is itself an offence.</p>
<p>Third, even if you could reliably block everyone to whom the laws apply, what do you do when the circumstances of the user’s you have allowed change? I’m an Australian in Australia so I’m covered by neither law (although there are Australian privacy laws that apply to me), if you collect my personal data and, 5 years later I move to Austria, the GDPR now applies to that data.</p>
<p>As you say “technology has vastly improved” - so have legal privacy protections.</p>

gdpr