gdpr data-protection google
Does Article 27(1) of the GDPR apply to a U.S. controller using Google Analytics if it only sells to U.S. clients?
<p>If a U.S. controller who only sells to U.S. clients uses Google Analytics on their website, would it be required to have a representative in the Union? I am unsure whether Google Analytics in this case would fall under Art 27(2)(a), exempting it from the obligation in paragraph 1.  </p>

<p>If a US data controller only targets people in the US with their services, the GDPR does not apply at all. Only those processing activities of a non-EU controller fall under the GDPR where those activities are related to (Art 3(2)):</p>

<ul>
<li>(a) the offering of goods or services to people in the EU, regardless of payment; or</li>
<li>(b) the monitoring of behaviour of data subjects, as far as the behaviour takes place in the EU.</li>
</ul>

<p>It could at most be argued that the use of website analytics could fall under (b) when a person in the EU accesses the site. If a controller is concerned about this, they can add filtering rules to GA to prevent non-US data from being stored. Some websites just block all EU visitors, but but that is likely not necessary and complete overkill.</p>

<p>The European Data Protection Board has issued <a href="https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-32018-territorial-scope-gdpr-article-3-version_en" rel="nofollow noreferrer">official guidance on the territorial scope of the GDPR</a>, with monitoring being discussed on section 2c. Their argument seems to be that “monitoring” doesn't cover all data collection but also depends on how that data is used. E.g. if you connect Google Analytics with AdWords, that would clearly be profiling in the sense of the GDPR and thus fall under monitoring. In default settings, the status of Google Analytics is less clear but I think it does just enough profiling to still count.</p>

<p>While processing of personal data for analytics is not generally “occasional” in the sense of Art 27(2)(a), here the processing that falls under the GDPR is only expected to be occasional. It would be reasonable to not appoint an EU representative.</p>
