How does that work with an EU citizen living outside the EU? Every business would either have to apply GPDR universally, or they’d have to know which customers are citizens, even in their local jurisdiction. Most just look at your IP address, which is not accurate.

Yes, that is basically the idea. it can only be enforced for european citizens, but everyone must comply.

> everyone must comply.

Enforcement is going to be difficult for companies owned and operating entirely outside the EU. Of course that doesn’t apply to T-Mobile.

Imagine a local store with a simple website but purchasing is done all in-store. They ask for your email address and record your credit card information at an in-person sale. They'd be in non-compliance if you were an EU citizen (if they didn't conform to GDPR), or? Or does this not apply being not in reach of EU laws?

> Or does this not apply being not in reach of EU laws?

It does apply as GDPR has no geographical limit according to the EU but they have to catch you and be able to prosecute which isn't going to be a straight pathway unless the business operates in the EU somehow.

Once you've complied, why not apply it to every user?

I've always wondered that about GDPR compliance. Once your company has gone through all the effort and expense to comply with GDPR, why take on the additional expense and complexity trying to conditionally apply all this new business logic only to EU people? Wouldn't it be simpler to just use your GDPR-compliant business logic for everyone? Why maintain EU and non-EU silos?

Sometimes it's not possible, just look at the CloudAct. It's incompatible with GDPR and still they try it with useless agreements like Privacy Shield and Safe Harbor.

It's like squaring the circle.

I don't know if it should, but it certainly does not.

I think this is a big part of the problem with the philosophy of GDPR.

It's kind of funny how colonial the mindset is, the sheer arrogance of telling foreign countries that they must treat EU citizens in a special manner.

You mean like the US who claims that all international subsidiaries must comply with US laws (even if it violates local law)?