Bad news friend. You have to comply with GDPR if any of your users are in the EU, even if they were originally not in the EU when they signed up. Your user merely needs to be a EU resident.

https://en.wikipedia.org/wiki/General_Data_Protection_Regula...

---

The regulation applies if the data controller (an organization that collects data from EU residents) or processor (an organization that processes data on behalf of data controller e.g. cloud service providers) or the data subject (person) is based in the EU. Furthermore the regulation also applies to organizations based outside the European Union if they collect or process personal data of EU residents. According to the European Commission "personal data is any information relating to an individual, whether it relates to his or her private, professional or public life. It can be anything from a name, a home address, a photo, an email address, bank details, posts on social networking websites, medical information, or a computer’s IP address."

---

If you don't have an organization in EU, they can't sue you in the U.S. because it's allowed here. It's like the U.S. trying to sue local Amsterdam pot shop because they sell drugs to U.S. residents.

I have bad news for you: things like the Uniform Foreign Money Judgments Recognition Act exist which makes it possible to enforce foreign verdicts. Even if no such law applies, most US companies that do business with EU customers have by definition some assets in the EU even if only briefly (or else they couldn't charge them anything).

The US doesn't sue foreign pot shops because the sale happens abroad and they have decided to not bother with that but they absolutely could enacted such a law if they wanted. Who is there to stop them? The US actually does apply some of its laws abroad. Here is an example that is similar to yours https://www.insightcrime.org/news/analysis/as-us-prosecutes-...

Again, the problem is only enforceability. If they can't get hold of any money, a verdict is useless.

That's the point. If I run a US-based company and have 0 assets in X country, it doesn't matter. EU lawyers would also know this and also wouldn't bring it to court. It's just a waste of everyone's time. I'm certainly not going to do anything If I get a summons from a random country due to some random law. Especially if it means nothing in the country I'm currently located in.

It does matter if your bank will comply, and no bank will risk getting banned from the EU market for a small customer like you.

Some day you’ll wake up, and notice all your corporate bank accounts are empty and frozen.

And you have no plans to have assets or employees in the EU. Ever.

The cookie law makes perfect sense: most uses of cookies don't require any notification, only "invisible" tracking cookies need that.

Common confusion over the cookie law.

* It was never about all cookies. It was about 3rd party cookies.

* An agreement was only necessary if you were transferring a user's private data to a 3rd party.

It was a huge privacy leak. The EU tried to shut it down, so the world's corporations decided to keep doing what they were doing without changing a thing, whilst mocking cookies, and by proxy, the user's whose data they were fleecing.

Every websites use Google Analytics - or another third part analytics - and therefore has to display the modal. This law is just a waste of everything.