It’s questionable as to whether or not judgements under the GDPR can be enforced in the US. There are existing treaties that generally enable this, but those also allow for a large number of exceptions. One of those exceptions is usually where something is illegal in one country and not illegal in the other, but we’ve been told there may be exceptions to that as well. It’s a big mess, but generally it would be up to a US judge in each individual case to decide whether the judgment can be domesticated.

However, recital 23 makes it clear that you do not need to comply with GDPR unless ”it is apparent that [you] envisage offering services to data subjects in one or more Member States in the Union”. In other words, it’s not your fault if you are a US-based site and it goes viral in the EU unless it was targeted to them.

Don’t translate to EU only languages, mention EU users or customers, or use an EU-based domain extension. You can also announce your intention to not serve EU customers by blocking EU visitors. Even though some EU traffic may get to your site through VPNs etc, merely trying to block them is more than enough to show that you do not “envisage” serving EU customers, which makes you not subject to GDPR. Those EU users that evade your block through technical means are not subject to the protections of the GDPR.

Finally, one law firm suggested that we put a checkbox similar to this on our registration forms:

”This website was designed to comply with US privacy laws. By checking this box, you attest that you are NOT subject to any law or regulation that conflicts with or is more restrictive than US privacy laws, including but not limited to the GDPR.”