Hacker News Reader

I understand why you think this way. After all, GDPR is about human rights!

In practice, GDPR is binding on businesses that operate within the EU. An EU citizen in the US doing business with a US-only company is not afforded any protections under GDPR.

> Provided your company doesn't specifically target its services at individuals in the EU, it is not subject to the rules of the GDPR.

https://ec.europa.eu/info/law/law-topic/data-protection/refo...

Genuinely curious; how is that even remotely possible to enforce?

It's not. If you have any legal disagreement with a company outside the EU they tell you to complain on that company origin.

I experienced this myself. EU is absolutely powerless outside their borders.

The way things are going, we'll start whole services shutting down completely, just to avoid trying to handle people's data responsibly.

If the business has no presence in the EU, then the EU is impotent to enforce their law.

This is factually untrue.