gdpr privacy
Do I still need to check if users are inside of EEA/UK for GDPR consent if my Android app is ONLY released in countries outside of EEA/UK?
<p>Example:</p>
<ul>
<li>A US user downloads the Android app from the US Google Play Store</li>
<li>The user does not view any consent form and begins using the app and viewing ads</li>
<li>The user then travels to EEA/UK and continues viewing ads</li>
</ul>
<p>Would a consent form be required to adhere to GDPR in this instance, even if personalised ads are disabled for EEA/UK users?</p>

<p>The GDPR roughly applies in the following scenarios:</p>
<ul>
<li>Art 3(1): you have an establishment in Europe</li>
<li>Art 3(2): you do not have an european establishment, but
<ul>
<li>Art 3(2)(a): offer goods or services to persons in Europe</li>
<li>Art 3(2)(b): monitor the behaviour of people who are in Europe</li>
</ul>
</li>
</ul>
<p>(where <em>Europe</em> means EU/EEA/UK as appropriate).</p>
<p>Art 3(1) does not seem to apply for you. Art 3(2)(a) does not apply, since you're not actively targeting people in Europe. At the point in time where you are offering the app to users, those users are in the US.</p>
<p>Art 3(2)(b) could apply if you collect some kind of tracking data, in particular (but not limited to) location data. But if you temporarily shut down collection of new data for personalisation while the user is in Europe, that's probably going to be reasonably safe. It might not be necessary to disable ad personalisation if that personalisation is based on data collected outside of Europe. In practice, unless your app is specifically targeted at travellers, no one will care about what your app does outside of the US.</p>
<p>For detailed guidelines on the territorial scope of the GDPR, consider reading <a href="https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-32018-territorial-scope-gdpr-article-3-version_en" rel="noreferrer">EDPB guidelines 3/2018 (PDF)</a>. The document contains some relevant examples, but since it's official guidance they won't explicitly say that GDPR won't apply in a scenario like yours. The closest is Example 8:</p>
<blockquote>
<p>An Australian company offers a mobile news and video content service, based on users’ preferences and interest. Users can receive daily or weekly updates. The service is offered exclusively to users located in Australia, who must provide an Australian phone number when subscribing.</p>
<p>An Australian subscriber of the service travels to Germany on holiday and continues using the service.</p>
<p>Although the Australian subscriber will be using the service while in the EU, the service is not ‘targeting’ individuals  in  the  Union,  but  targets  only  individuals  in  Australia,  and  so  the  processing  of  personal data by the Australian company does not fall within the scope of the GDPR.</p>
</blockquote>
<p>Also relevant is Example 10, which says that app downloads in the EU might not be subject to GDPR:</p>
<blockquote>
<p>A  U.S.  citizen  is  travelling  through  Europe  during  his  holidays.  While  in  Europe,  he downloads and uses a news app that is offered by a U.S. company. The app is exclusively directed at
the U.S. market, evident by the app terms of use and the indication of US Dollar as the sole currency available for payment. The collection of the U.S. tourist's personal data via the app by the U.S. company is not subject to the GDPR.</p>
</blockquote>

<p>The GDPR applies to interactions with any users who are <strong>currently</strong> inside the EU, even if they were not in the EU when the first accessed the service, or indeed the day before. If a person currently in the EU uses the service and personal information (PI) is collected or processed as a result of that interaction, there must be a lawful basis, often user consent. This is covered by <a href="https://gdpr-info.eu/art-3-gdpr/" rel="nofollow noreferrer">GDPR article 3</a> on territorial scope, and <a href="https://gdpr-info.eu/art-6-gdpr/" rel="nofollow noreferrer">GDPR article 6</a> on lawfulness of processing.</p>
<p>However, the GDPR does not apply at all if the Data Controller (DC) is outside the EU <strong>and</strong> the service does not &quot;target&quot; any areas in the EU (member countries or parts of member countries) and also does not &quot;monitor behavior&quot; of people in the EU. If the service is not advertised in the EU, and is not provided in EU languages that are not languages of the country where the DC is located, fees (if any) are collected only in non-EU currency, and efforts are made to exclude people resident in the EU, that might be sufficient evidence that people in the EU are not being targeted.</p>
<p>See <a href="https://gdpr-info.eu/recitals/no-23/" rel="nofollow noreferrer">GDPR Recital 23</a> for more on targeting.</p>
<p>If a service <strong>is</strong> targeting the EU, it may be simpler to ask for consent from all users than to try to determine who is and who is not in the EU to apply different rules.</p>
<p>Note also that if the DC (or the relevant establishment of the DC) is located in the EU, then the GDPR applies to all transactions and all PI processed, no matter where the data subject is located, and either consent or some other lawful basis is required.</p>
