GDPR's Long Arm: How the Regulation Reaches US Companies Without EU Presence

GDPR applies globally based on data processing activity, not company location or size—a deliberate design to prevent regulatory arbitrage. Most US companies unknowingly trigger compliance through the 'targeting test,' which applies whenever they offer services to or monitor EU residents, even without intentional targeting. Understanding this extraterritorial reach is critical, as widespread misconceptions about size and geography create substantial compliance risks.