Does GDPR Apply to a US Small Business?

Disclosure: Some links are sponsored. We may earn a commission if you sign up for or buy a product through them, at no extra cost to you. This is general information, not legal advice.

Last reviewed: October 15, 2026 by the Smart Savings Guides editorial team. How we research and update articles.

Not legal advice: this is a plain-English summary to help you ask the right questions. Which laws apply depends on where you and your visitors are, what data you collect and how big your business is. For anything high-stakes, talk to a lawyer licensed where you operate.

Many US small business owners assume the EU's General Data Protection Regulation (GDPR) only matters to big tech companies or businesses with offices in Europe. That's not quite right, and it isn't true that it applies to every website either. Whether it applies to you comes down to two tests in Article 3 of the regulation. This guide explains them with plain examples and lists what to do if you're covered.

Quick answer

GDPR can apply to a US business with no EU presence if it offers goods or services to people in the EU (paid or free), or monitors their behavior in the EU.
A website that people in the EU can simply visit is not enough on its own, according to the regulation's recitals and official EU guidance.
Selling to UK customers brings in the UK GDPR, which is very similar.
If GDPR applies, you need a lawful basis for processing, a clear privacy notice, a way to handle people's data rights and, in many cases, an EU representative.

Need a privacy policy that covers GDPR?

Sponsored link: we may earn a commission if you sign up or buy through it, at no extra cost to you.

Try Termly's policy generator

Opens Termly's privacy policy generator. The free plan covers one basic policy; paid plans are listed on Termly's Pricing page (Starter from $10 and Pro+ from $15 per website a month, billed annually, checked October 15, 2026). A generator only reflects your answers and isn't legal advice.

Our Termly partner link is set up for readers in the US. If you're outside the US, you can go to Termly's website directly.

Test 1: are you offering goods or services to people in the EU?

Under Article 3(2)(a) of the GDPR, the regulation applies to a business outside the EU when it processes personal data of people who are in the EU in connection with offering them goods or services, whether or not they have to pay.

Recital 23 of the regulation explains how to tell. The mere fact that your website, email address or contact details can be reached from the EU, or that it's in a language generally used in your own country, is not enough. What counts is whether it's apparent that you envisage offering to people in the EU. Signs of that include using a language or currency of an EU country with the option of ordering in it, or mentioning customers or users in the EU.

The European Data Protection Board's Guidelines 3/2018 on territorial scope list more factors, including:

shipping goods to EU countries, or giving EU contact numbers or addresses;
paying for search or ads aimed at people in an EU country;
naming EU countries when describing your service, or using an EU country's top-level domain such as .de or .fr;
offering travel directions from EU countries to your location, or citing EU clients.

Test 2: are you monitoring behavior in the EU?

Article 3(2)(b) covers businesses that monitor the behavior of people in the EU, as far as that behavior takes place in the EU. Recital 24 points to tracking people online, including profiling to analyze or predict their preferences and behavior. The EDPB guidelines give examples such as behavioral advertising, online tracking through cookies or other techniques, and personalized diet or health analytics. The guidelines say monitoring implies a specific purpose in collecting and reusing the data, so not every bit of collection is monitoring.

That's why your choice of analytics and ad tools matters. Running retargeting pixels or detailed behavioral tracking on visitors from the EU is far more likely to bring you into scope than a site that only counts visits in aggregate.

Examples

Business	Likely position
A US bakery with a local website, US prices and local delivery only	Probably outside GDPR, even if someone in France visits the site.
A US online store that ships to the EU, shows prices in euros or lists EU shipping rates	Very likely offering goods to people in the EU, so GDPR applies to that processing.
A US consultant who runs ad campaigns targeted at Germany	Likely in scope for the people reached through that targeting.
A US blog with behavioral ad tracking that follows visitors, including EU visitors	Could count as monitoring. Get advice if a meaningful part of your audience is in the EU.

These are illustrations, not legal conclusions. Real cases depend on the details.

If GDPR applies: the main obligations

A lawful basis for each use of personal data (Article 6), such as performing a contract, consent, or legitimate interests.
A clear privacy notice (Articles 13 and 14) saying who you are, what you collect, why, your lawful basis, who you share it with, how long you keep it, international transfers, and people's rights.
Handling rights requests such as access, correction, deletion and objection (Articles 15 to 22), usually within one month.
Contracts with processors such as your email platform or host (Article 28).
Security and breach notification: reporting certain personal data breaches to the supervisory authority within 72 hours of becoming aware of them (Article 33).
An EU representative (Article 27). A business outside the EU that's covered by Article 3(2) generally has to appoint one in an EU country where the people it serves are, unless its processing is occasional, doesn't include large-scale processing of sensitive data, and is unlikely to result in a risk to people's rights.

Cookies and similar trackers also fall under the EU's separate ePrivacy rules, which generally require consent for non-essential cookies. See do I need a cookie consent banner?

What about UK customers?

After Brexit, the UK kept its own version, the UK GDPR, enforced by the Information Commissioner's Office. Its territorial rules mirror the EU ones, so offering goods or services to people in the UK, or monitoring them, can bring a US business into scope there too, with a possible need for a UK representative.

What's at stake

Article 83 allows fines of up to €20 million or 4% of worldwide annual turnover, whichever is higher, for the most serious breaches. Most small businesses will never face anything like that, but the realistic risks are complaints, requests you can't answer, and partners or platforms asking you to show compliance.

A practical checklist

Decide honestly whether you target or monitor people in the EU or UK, using the factors above.
Map the personal data you collect: forms, orders, email lists, analytics, ad pixels.
Remove tracking you don't need. Aggregate, cookie-free analytics is far easier to justify than cross-site tracking.
Publish a privacy policy that covers GDPR's required information. See does my website need a privacy policy?
Set up a consent banner if you use non-essential cookies with EU or UK visitors.
Check the representative rule, and get legal advice if you process sensitive data or a lot of EU data.

Sources

Official sources this article relies on, checked October 15, 2026. Rules and prices change, so confirm details at the source.

Generating the policy: Termly

We may earn a commission if you sign up or buy through these links, at no extra cost to you. This is a sponsored link.

If you've decided GDPR applies, the privacy notice is the visible part of the job. Termly asks questions about your site and generates a policy from your answers. Its free plan covers one basic policy. Its Pricing page (checked October 15, 2026) lists Starter from $10 and Pro+ from $15 per website a month, billed annually; Pro+ adds unlimited policies and edits, auto-updated policies, Google Consent Mode v2 and IAB TCF 2.3 support, multi-language support and regional consent rules. A generator only reflects your answers, so review the result. Read our Termly review.

Try Termly's policy generator

Sponsored link. Start on the free plan; upgrade only if you need more policies, edits or consent features. Our Termly partner link is set up for readers in the US. If you're outside the US, you can go to Termly's website directly.

Frequently asked questions

Does GDPR apply if EU visitors can see my US website?

Not on that fact alone. The GDPR's recitals say mere accessibility of a website from the EU isn't enough. It applies if you target people in the EU with goods or services, or monitor their behavior.

Do I need an EU representative as a small US business?

If GDPR applies to you under Article 3(2), you generally do, unless your processing is occasional, excludes large-scale sensitive data and is unlikely to put people's rights at risk.

Does GDPR apply to EU citizens living in the US?

Article 3(2) focuses on people who are in the EU, not on nationality. An EU citizen living in the US and buying from you there isn't, on that basis alone, protected by GDPR.

Is the UK GDPR different from the EU GDPR?

It's very similar, including its territorial rules, but it's a separate law enforced by the UK's Information Commissioner's Office.

More guides

← Back to the main guide