In short
The General Data Protection Regulation (GDPR) can apply to your US business if you offer goods or services to people in the EU or monitor their behavior, even if you have no office there. The US has no single federal equivalent, but a growing number of states have their own privacy laws.
This guide covers who enforces the GDPR, what it requires (a lawful basis, a privacy policy, valid consent, data transfers through the EU-US Data Privacy Framework or standard contractual clauses, and, where required, an EU representative and a DPO) and a practical checklist for US companies.
Since its enforcement in 2018, one of the most asked questions about GDPR has been: does the GDPR apply outside the European Union? And, more specifically: does it apply to US companies? If yes, what are the requirements for GDPR in the US?
In this post, we’ll give you all the background information needed to answer the questions above and get a clear understanding of GDPR applied to the US. We also provide an actionable checklist for US companies, including detailed steps they may need to take to meet GDPR requirements and lower their legal risk. Let’s get started!
In this article:
Does the GDPR apply to the US?
Yes, the GDPR may apply in the US, or in any country in the world. Even though it does not have jurisdiction in the United States, its provisions have an extraterritorial scope, meaning that GDPR requirements can apply outside the European Union.
The regulation is meant to protect European individuals and their data. As a result, the GDPR also extends to foreign companies that, based outside the EU, engage in specific activities involving European residents.
Article 3 of the GDPR states:
This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not. Article 3(2) adds that it also applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing relates to (a) the offering of goods or services to such data subjects in the Union, or (b) the monitoring of their behaviour as far as it takes place within the Union.
Specifically, for the GDPR to apply to your US business, you should meet at least one of the following requirements:
- Your business is based in the EU (please note that this applies even in the case of an EU-branch office); or
- You’re not based in the EU, but you offer goods or services (even for free) to EU-based users; or
- You’re not based in the EU, but you monitor the behavior of EU-based users.
In short, if you’re a US-based company, and you offer goods or services to people in the EU, or monitor their behavior, you’re expected to comply with the GDPR, even if you have no office there.
See an example here
Here’s a practical example, taken from the European Data Protection Board guidelines:
A start-up established in the USA, without any business presence or establishment in the EU, provides a city-mapping application for tourists. The application processes personal data concerning the location of customers using the app, in order to offer targeted advertisement for places to visit, restaurant, bars and hotels. The application is available for tourists while they visit New York, San Francisco, Toronto, Paris and Rome. The US start-up is specifically targeting individuals in the Union (namely in Paris and Rome) through offering its services to them when they are in the Union. The processing of the EU-based data subjects’ personal data together with the offering of the service falls within the scope of the GDPR. Furthermore, by processing data subject’s location data in order to offer targeted advertisement, the processing activities also relate to the monitoring of behavior of individuals in the Union. The US start-up processing therefore also falls within the scope of the GDPR as per Article 3(2)
Does the GDPR apply to US citizens?
Yes, the GDPR applies to US citizens that are physically located in the European Union. It applies to any individual, regardless of nationality, as long as they are physically located in the European Economic Area (EEA) at the time their personal data is processed, and the company is established in the EU or targets or monitors people there.
For example, if a US citizen visits France on vacation and uses an app to buy train tickets, the GDPR applies because the app offers its service to people while they are in the EU. The regulation is territorial, meaning it protects the data of individuals based on their location, not their citizenship.
Does the GDPR apply to EU citizens in the US?
In most cases, the GDPR does not apply to EU citizens while they are in the United States, because the regulation primarily protects individuals who are located in the EEA at the time of data processing.
However, there are exceptions. The GDPR may still apply if:
- An EU-based company processes the data of an EU citizen in the US (e.g., an EU bank handling an EU citizen’s account).
- A US company processes an EU citizen’s data on behalf of an EU-based organization (the EU organization is subject to the GDPR, and the US company is bound by contract under Article 28 and by the transfer rules).
- The data was originally collected in the EU and continues to be subject to GDPR rules.
While the GDPR does not automatically follow EU citizens wherever they go, it can still apply in specific cases, particularly when EU-based entities or services subject to the GDPR are involved in processing their data.
Do US companies have to comply with UK GDPR?
The UK GDPR is the UK equivalent of the General Data Protection Regulations, which has applied since January 1, 2021, after Brexit.
As the EU GDPR, the UK GDPR also applies outside the UK if you:
- offer goods or services to individuals in the UK; or
- monitor the behavior of individuals taking place in the UK.
If your US business falls into one of these categories, then you need to comply with the UK GDPR as well.
Who enforces GDPR in the US?
The GDPR in the US is typically enforced by Data Protection Authorities (or DPAs), which are independent public authorities established in each EU member state. It is not enforced by any US agency or authority because it is a European Union regulation, even though its reach extends outside the EU.
DPAs supervise the application of the GDPR within their respective territories. They also conduct investigations, issue fines and sanctions, and provide guidance on best practices for complying with the GDPR and relevant national laws. There is one in each EU member state: for instance, it’s called the CNIL in France and the Garante in Italy.
If a US-based company is in violation of GDPR, there is no single lead regulator: the DPA of every EU country where affected individuals are located can take action, and several may act in parallel.
In case the US company has its main establishment in an EU Member State (e.g. its EU headquarters), the DPA of that specific state becomes the primary or lead regulator for that business. This DPA would be responsible for coordinating any enforcement actions with its counterparts in other EU states where violations may have occurred.
What is the GDPR equivalent in the US?
There is no GDPR equivalent in the US, meaning there isn’t a single federal law that is similar to the GDPR.
A federal act, the American Privacy Rights Act, was proposed in 2024 but never passed. In April 2026, House Republicans introduced a new federal privacy bill, the SECURE Data Act, which would preempt most state privacy laws; it has not been enacted.
However, some states have privacy laws, such as the California Privacy Rights Act (CPRA), that usually apply only to residents of that particular state.
In recent years, a growing number of US states have passed privacy laws, like Virginia with the VCDPA, Colorado with the CPA, Utah with the UCPA and Connecticut with the CTDPA. Today, 20 state privacy laws are in force (counting Florida’s narrower Digital Bill of Rights), and 4 more were enacted in 2026. See our overview of US state privacy laws.
None of the US state privacy laws are as comprehensive as the GDPR yet, but they help protect, grant consumer rights and introduce legal requirements for companies that process personal data of residents of the state. For example, businesses are required to include specific disclosures in a privacy policy or display a notice to inform consumers of data collection practices.
The country also has some sector-specific laws governing different types of data and industries, like HIPAA that regulates healthcare data or the Gramm-Leach-Bliley Act for financial data. HIPAA is enforced by the Department of Health and Human Services’ Office for Civil Rights, the GLBA by the Federal Trade Commission (FTC), the CFPB, federal banking regulators and state insurance authorities.
More on US state privacy laws
Today, 20 US state privacy laws are in force (counting Florida’s narrower Digital Bill of Rights), and 4 more take effect in 2027 and 2028. Check when each law takes effect.
These US laws require, among others, that you:
- Provide your users with a privacy policy including specific details. For example, you need to disclose some additional information, such as users’ rights and describe your data processing practices.
- Enable your users to opt out of the processing for certain purposes (sale, targeted advertising and sharing, among others).
- Most state laws (all except California, Utah and Iowa): enable your users to opt in to the processing of their sensitive data.
- CPRA only: show users the required notice at collection to inform them about the categories of personal information that are collected, the purposes of collection, and whether this information is sold or shared.
For a quick recap, watch this video:
How can the GDPR affect US companies?
As we’ve demonstrated above, it’s a mistake to think that, since the GDPR is a European regulation, it doesn’t affect US businesses at all.
Overall, it is strongly recommended for US companies to assess their data processing activities and consult legal experts to determine if compliance to the GDPR in the US is required in their specific situation.
Penalties for non-compliance to GDPR in the US can be significant. They can be monetary, or not:
- Fines can go up to EUR 20 million (€20m) or 4% of the annual worldwide turnover (whichever is greater) for the most serious infringements; a EUR 10 million or 2% tier applies to others.
- Equally concerning are the other potential sanctions: official reprimands, orders to bring processing into compliance, temporary or definitive bans on processing, and compensation claims by individuals (Art. 82).
Did you know you can work towards both US privacy laws and the GDPR at the same time?
With iubenda, simply select which region you are based in, then where your users are based, and our solution does the rest! It suggests a configuration based on the regulations that apply to you.
GDPR in the US: main requirements
As a US-based business, here are the main GDPR requirements you must follow.
Have a lawful basis
Before you can collect or process any personal data, the GDPR mandates that you have at least one lawful basis for doing so. These lawful bases are:
- The user has given consent for one or more specific purposes.
- The data processing is necessary for the performance of a contract or in order to take steps prior to entering the contract.
- Other legal bases: the processing is necessary for fulfilling a legal obligation, protecting the vital interests of a person, performing a task carried out in the public interest, or the legitimate interests of the data controller or a third party.
You must identify and document the lawful basis for each specific data processing activity you undertake.
Make legally required disclosures via your privacy policy
GDPR compliance in the US requires you to provide your users with a privacy policy, where you include all the details regarding your data processing activities.
Under the GDPR, your privacy policy should at least include:
- Who is the site/app owner? Contact details of your DPO and EU representative, if any.
- What data is being collected and how? How long will it be kept?
- What is the legal basis for the collection?
- Why are you collecting the data?
- Are there any third parties involved in the processing? If yes, what are they?
- Do you transfer data abroad? If yes, what security measures are in place to safeguard the data?
- What rights do users have? How can they exercise them? This includes withdrawing consent and lodging a complaint with a data protection authority.
- How will you notify your users of any changes in the policy? (good practice)
- The effective date of the policy. (good practice)
Remember to add your privacy policy where it’s easily accessible, for example in the footer of your website. You can learn more here: What is a Privacy Policy and Do You Need One?
Collect valid consent (where you rely on it)
While US legislations typically allow the collection and processing of personal data without obtaining the user’s prior consent, the GDPR requires that you collect “freely given, specific, informed and unambiguous” consent through a clear opt-in, or positive action.
This essentially means that where you rely on consent, and for non-essential cookies and similar trackers (which need prior consent under the EU ePrivacy rules), you must ask before collecting the data. This mechanism must be unambiguous: “opt-out” mechanisms like pre-ticked boxes are forbidden.
You should also grant users the right to withdraw consent. It must be as easy to withdraw consent as it is to give it. To learn more about the rights of European residents under the GDPR, read this guide.
Your consent forms must be straightforward, easy to understand and conspicuous. Individuals should actively opt in.
Keep clear records related to the consent
If you rely on consent, you must be able to prove it. To do so, keep records of what information was disclosed, how the consent was obtained (e.g. via a website form), and when it was obtained.
Companies need to maintain clear consent records that can prove that individuals provided informed consent. This adds a complex administrative layer but is essential for compliance.
As you can imagine, this is not an easy task! That’s why we recommend using a Consent Database.
Assess cross-border data transfers between the EU and the US
The GDPR allows transfers of EU residents’ data outside of the European Economic Area (EEA) only when certain conditions are met.
Under GDPR requirements, the country or region the data is being transferred to must have an “adequate” level of personal data protection by EU standards, or where not considered adequate, transfers may still be allowed under the use of standard contractual clauses (SCCs) or binding corporate rules (BCRs), or other tools listed in Article 46 (for occasional transfers, the derogations in Article 49 may apply).
A decision was taken on the EU-US Data Privacy Framework on July 10, 2023 recognizing that US organizations certified under the framework provide an adequate level of protection. Consequently, personal data can now flow freely from the EU to US self-certified companies without the need for additional safeguards. The framework remains in force, but it is being challenged before the EU Court of Justice, so many companies keep standard contractual clauses in place as a fallback.
EU-US data transfers are allowed for US organizations that have been certified. To self-certify, you need to meet the privacy principles of the Data Privacy Framework: only then is your company added to the DPF list. Here’s how to self-certify.
Appoint an EU representative and, where required, a Data Protection Officer (DPO)
If you’re based outside the EU and the GDPR applies to you under Article 3(2), you must appoint a representative in the EU (Article 27), unless your processing is occasional, does not involve large-scale processing of sensitive (special-category) or criminal-offense data, and is unlikely to result in a risk to individuals. The representative acts as your contact point for EU authorities and individuals. You may also need a Data Protection Officer, or DPO, who is in charge of ensuring that personal data is processed following the applicable data protection rules.
However, the appointment of a DPO is not always mandatory, it depends on the scale and nature of data processing activities. Specifically, you need to appoint a DPO when:
- Your core activities involve regular and systematic monitoring of individuals on a large scale (for example, processing with video surveillance systems).
- The processing is carried out by a public authority (except for courts acting in their judicial capacity).
- Your core activities involve large-scale processing of sensitive data (special categories) or data about criminal convictions and offenses.
Are you selecting a DPO? Here’s what to look for.
Carry out a Data Protection Impact Assessment (DPIA)
For data processing activities that are likely to result in high risks to individuals, the GDPR requires a Data Protection Impact Assessment (DPIA) to be carried out. This is an assessment that evaluates how personal data is processed and how to mitigate risks to data subjects.
This involves identifying the nature, scope, context, and purpose of the data processing, assessing the risks to individuals, and identifying measures to mitigate those risks.
GDPR compliance checklist for US companies
Here’s a practical checklist to help you navigate GDPR compliance as a US-based business.
- Identify, assess and review your data collection and storage practices, and where they take place.
- Establish a valid legal basis for processing personal data.
- Have an up-to-date, easily accessible privacy and cookie policy on your website/app.
- Make the following legally-required disclosures in your privacy policy: types of personal data collected, why, and if applicable the third parties with whom the data is shared; as well as individuals’ GDPR rights over their own data.
- For transfers of EU data to the US, rely on the EU-US Data Privacy Framework (if you or your recipient are certified) or another transfer tool, such as standard contractual clauses.
- Collect user consent to the use of their data in an unambiguous way, via a clear affirmative action (opt-in).
- Make it as easy to withdraw consent (opt-out) or object to specific activities, as it is to give consent.
- Obtain consent to your activities through contact/newsletter/registration forms in a transparent way, providing a link to your privacy policy.
- Maintain clear records of consent, with details like timestamp, preferences expressed and the specific form used.
- Implement straightforward procedures to fulfill individuals’ requests to exercise their rights, e.g. access, correct, update or delete the data you hold on them.
- If your processing is large scale or high risk: appoint a DPO and carry out a DPIA.
- Put in place and be able to demonstrate robust security measures (e.g. against data breaches), records of data activities and transfers.
So, how can you get started right away and check most of the boxes above in just a few minutes?
How iubenda can help with GDPR in the US
Reading all this can be quite overwhelming. We get it: it’s technically and legally complex. The good news is that you don’t have to handle it alone.
iubenda provides attorney-level compliance software that helps you meet GDPR requirements in the US:
- GDPR and beyond: set up your websites and apps for the requirements of multiple countries and laws
- Lower your legal risk: we built our solutions with the strictest regulations in mind
- Fully customizable: generate your own privacy policy and a customized consent banner
Manage US and EU consent in one place
With iubenda’s Privacy Controls and Cookie Solution, generate a customizable, location-based consent banner. The right consent parameters, text, privacy policy link and language apply to the right users automatically.
Get started with GDPR compliance
Tick items off your GDPR checklist.