{
  "schema_version": "1.1",
  "id": "gdpr-only-applies-to-eu-companies",
  "slug": "gdpr-only-applies-to-eu-companies",
  "url": "https://groundedkit.com/claims/gdpr-only-applies-to-eu-companies/",
  "api_url": "https://groundedkit.com/api/claims/gdpr-only-applies-to-eu-companies.json",
  "claim": "GDPR only applies to companies based in the EU",
  "commonly_cited_as": "\"We're a US company, GDPR doesn't apply\"",
  "verdict": "misquoted",
  "verdict_definition": "Primary source found, but the way it is quoted changes the subject, metric, population or precision.",
  "confidence": "high",
  "rating": {
    "value": 2,
    "best": 5,
    "worst": 1
  },
  "origin": {
    "publisher": "European Union (GDPR Art. 3)",
    "title": "Regulation (EU) 2016/679, Article 3 (territorial scope)",
    "year": "2016 (applies since May 2018)"
  },
  "quote": "This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: the offering of goods or services",
  "method": "Text of the regulation (via gdpr-info.eu).",
  "drift": [
    "Scope: non-EU businesses are covered when they offer goods or services to, or monitor the behaviour of, people in the EU"
  ],
  "interest": "n/a (statutory or regulatory text).",
  "safe_rephrasing": "GDPR also covers businesses outside the EU when they offer goods or services to people in the EU or monitor their behaviour there.",
  "sources": [
    {
      "title": "GDPR Art. 3 (gdpr-info.eu)",
      "url": "https://gdpr-info.eu/art-3-gdpr/",
      "primary": true
    }
  ],
  "kind": "stat_check",
  "as_of": "In force",
  "last_checked": "2026-10-17",
  "stale": false,
  "date_reviewed": "2026-10-17",
  "license": "CC BY 4.0",
  "license_url": "https://creativecommons.org/licenses/by/4.0/"
}