gdpr
Blocking certain countries
<p>Due to some laws one wants to block certain countries from accessing his app which he uploaded  on play console.One turns off those countries in GOOGLE play console so it cannot be downloaded in those country.
Someone pirates it and aquires it.
In EULA one clearly specifies the blocked countries and reasons for ban . Then writes -</p>
<p>&quot;Use of this app is strictly prohibited if you are located or are a resident of or are a citizen or relate to anywhere outside the supported countries.You accept you are liable for any fines or damage we face if you continue.&quot;</p>
<p>So for EEA countries the users in EEA are told they are not allowed to use the app at all and must  not keep it . If they continue to use they take the responsiblity to pay any GDPR fines or liblity for us. Thus it is strictlgy priohibited. Is such an agreement legal?</p>

<h2><a href="https://dictionary.cambridge.org/dictionary/english/if-you-can-t-stand-the-heat-get-out-of-the-kitchen" rel="nofollow noreferrer">If you can’t stand the heat, get out of the kitchen</a></h2>
<p>The thrust of this question, as well as many others you have posted, seems to be looking for a way of avoiding your obligations under the GDPR because they are difficult, onerous and/or expensive.</p>
<h2>Too bad!</h2>
<p>You don’t have the option of which laws you comply with and which ones you don’t. If I had my choice, I’d comply with the GDPR and not with tax law, but I don’t so I can’t.</p>
<p>You have 3 simple choices:</p>
<ol>
<li>Do your best and insure the rest. This means learning what’s required and implementing it to the best of your ability and taking out appropriate insurance cover to deal with any mistakes you make.</li>
<li>Ignore the law and hope you don’t get caught.</li>
<li>Don’t release apps.</li>
</ol>

<p><strong>If</strong> GDPR applies, then trying to skirt your responsibilities with such terms of service would be blatantly illegal. A contract that tries to pass your fines on to users would not hold up in court. See also <a href="https://law.stackexchange.com/a/57761">Dale M's answer</a>.</p>
<p>However, GDPR might not apply to you. When we look into Art 3 GDPR (territorial scope), we find this:</p>
<blockquote>
<p>2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:</p>
<p>(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or</p>
<p>(b) the monitoring of their behaviour as far as their behaviour takes place within the Union.</p>
</blockquote>
<p>Translated from legalese to English: as a non-EU data controller, you do not have to comply with the GDPR <em>unless</em> you are monitoring/tracking/profiling persons in the EU, or if you are <em>offering</em> services to people in the EU.</p>
<p>This “offering” means that you must be actively targeting the EU market and reasonably expecting people in the EU to use your app. This is a lot about your intention and marketing, not so much about whether you effectively prevent people in the EU from using your app. Recital 23 provides some details:</p>
<blockquote>
<p>Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.</p>
</blockquote>
<p>Mere accessibility of your service doesn't matter. But e.g. if you were marketing your app in Polish, that could be an indication that you're targetting people in the EU. The <a href="https://edpb.europa.eu/our-work-tools/our-documents/riktlinjer/guidelines-32018-territorial-scope-gdpr-article-3-version_en" rel="nofollow noreferrer">EDPB guidelines 3/2018 on territorial scope</a> provide in-depth discussion of this “targeting criterion” and other aspects.</p>
<p>There is a question what measures you can take to make it clear that you're not offering services to people in the EU. Many websites block visitors from European IP addresses. I think that is effective, but goes beyond what would be actually required. You mention that you could prevent downloads from certain countries. Again, that sounds fairly effective, but might even go beyond what is required. However, text that is hidden somewhere in your terms of service does not sound particularly effective.</p>
<p>There is one gotcha though: the GDPR applies with regards to people <em>in</em> the EU, not people <em>from</em> the EU. If a user installs your app outside of the EU but then travels into the EU and uses your app there, we have to look into what your app is doing. You're clearly not offering/targeting goods or services. But monitoring the user's behaviour through the app could bring you into scope. The EDPB guidelines linked above contain an example of an app that is targetted towards tourists who visit EU cities. Such an app might monitor user behaviour such as location e.g. to alert users to nearby points of interest. Note that even if you don't intentionally monitor behaviour, some libraries or SDKs that you integrate might, especially advertising frameworks.</p>
