[ryanwaggoner]

First of all, this isn’t popular with the EU crowd here, but there’s no method of enforcement for GDPR for American companies without a presence in Europe. Good luck trying to collect a fine from some tiny business in the US

Second, you really think GDPR is going to be applied to some tiny American startup because they said they might do something and then didn’t?

Third, my understanding is that if you don’t target EU customers, GDPR doesn’t apply. It’s not enough that an EU customer happens to wander into your store. You have to have some accommodation targeting the EU (like translated pages, international shipping, different currencies, etc)

[ryanwaggoner]

Here’s the text from the European Commission:

When the regulation does not apply

Your company is service provider based outside the EU. It provides services to customers outside the EU. Its clients can use its services when they travel to other countries, including within the EU. Provided your company doesn't specifically target its services at individuals in the EU, it is not subject to the rules of the GDPR.

Source: https://ec.europa.eu/info/law/law-topic/data-protection/refo...