united-states gdpr data-protection
Does GDPR apply to data of users who lied about their country of residence?
<p>Imagine a website which requires users to register in order to use all its features. In order to avoid exposure to GDPR complains, would any of the following tactics work?</p>
<ul>
<li><p>Ask the user for their country of residence, and offer a list with EU countries not in it</p>
</li>
<li><p>Ask the user for their country of residence, and display an error message if an EU country is selected</p>
</li>
</ul>
<p>Practically, suppose a certain John Smith from Germany registers as John Smith from Arizona, US, and then requests a copy of their personal data under GDPR right of access, or complains about the collected data being excessive. Could his request/complain be dismissed on the ground that the website doesn't have any data concerning John Smith from Germany?</p>

<p>Whether GDPR applies does not depend on the country of residence. Instead, GDPR applies to a non-EU site or service if the data controller <em>offers</em> products or services to people in the EU (see Art 3(2) GDPR). This depends solely on the behaviour and intent of the data controller / the provider of the website – compare also the discussion of the “targeting criterion” in <a href="https://edpb.europa.eu/our-work-tools/our-documents/riktlinjer/guidelines-32018-territorial-scope-gdpr-article-3-version_en" rel="nofollow noreferrer">EDPB guidelines 3/2018 on the territorial scope of the GDPR</a>.</p>
<p>While your proposed measures might not be entirely ineffective (in that they document an intent to not serve people in the EU), they are both unnecessarily restrictive and overly lax. For example, they would unnecessarily prevent EU tourists in the US from registering but would nevertheless allow US tourists in the EU. For the targeting criterion, it matters whether the data subject is in the EU at the time of the offer, not at all what their residency is. Even if a person who is currently in the EU registers with your service, that doesn't necessarily mean that you are <em>targeting</em> people in the EU.</p>
<p>Instead of implementing signup restrictions, a better strategy might be to clarify in the copy on your website that you are only targeting the domestic US market, not the European market with your services. I have discussed this in more detail in an <a href="https://law.stackexchange.com/a/59348/20476">answer to “How can you block GDPR users from US based sites?”</a></p>
<p>If you have a site where GDPR doesn't apply, and you receive a GDPR data subject request, you shouldn't deny it on the basis that the user must have lied – instead you can deny it on the basis that GDPR just doesn't apply to you.</p>
