Can any national European company do business in all other member states? For example, could a limited liability company registered in a Baltic EU state offer services in Poland? What I learn from the first comment to this question, this might depend for example on services nature. So these should be online subscription services. But where to read such things, are these national regulation laws defining which companies types from what countries allow to do what?
Yes. A company from one member state may do business in any E.U. state so long as it complies with local law in the course of doing so. For example, a Dutch company doing business in Germany must still pay German taxes and comply with German labor laws for its German employees. But, it doesn't have to form a German subsidiary to do business in Germany.
The law of each country where you offer the app for download applies, and you have to consider: Privacy Policy (GDPR in EU, CCPA in California, APPI in Japan, LGPD in Brasil, and more - check each country to be on the safe side) Disclaimer versus AGB/Terms and Conditions (e.g. Germany), not required but recommended Impressum (Germany, Switzerland, Austria) Value Added Tax (VAT) which is taken care of e.g. by Google Play for most countries but not all (e.g. not for Japan) in case the app is not free Consumer Protection Law - applicable (and different) everywhere There might be more, but these are the important ones I am aware of.
Yes, non-US citizens can own equity in US companies. To be specific: You do not have to be a citizen or resident of the US to own securities in a company incorporated in the US.
I can't answer this for all of Europe, but in the UK you can pick your company name as long as it cannot be confused with the name of another UK company (and some other rules, like you cannot name it Her Royal Majesty's Game Studio). Both companies may want to register trademarks, and if they register a trademark in the USA that you registered in the EU, then they cannot use their trademark in the EU, and you can't use yours in the USA. You can register your trademark in the USA if you're quicker. When you try to register a trademark in the USA, anyone with a valid interest can protest against it. If they notice the registration, they will most likely succeed if they object. If they don't notice – well, that's tough for them. I wouldn't say it's impossible to overcome your trademark, but it would be hard.
Is this legal? Generally yes, unless it unlawfully exceeds the scope of the license. Also, if it is, how can I check if it's permitted by the original store's EULA? Read the whole EULA, focusing on terms related to resale, assignment, and transferability.
The territorial scope of the GDPR is defined in Article 3. It covers "personal data of data subjects who are in the Union", whether they are EU citizens or not. So to answer your questions: 1) are EU users, but moved to USA a few years ago, and signed-up on my website? They are not in the EU, so are not covered. You don't need to know if someone is an EU citizen, just if they are currently in the EU. 2) went for holidays in USA, signed-up on my website, and then came back to EU? (note - potentially skipped any Consent questions at sign-up, because IP was from USA) If someone moves into the EU while using your service then they fall under the GDPR for the time they are in the EU. If their home address is in the EU then that is covered, and monitoring of their behaviour while in the EU is also covered. Your other two questions are about VPNs. If a VPN is used to evade IP address geolocation and you have no other clue about where someone is then you can't be blamed for not knowing where they are (although I'm not aware of any actual case law on this topic). But if someone with a USA IP address gives a home address in the EU then you should probably treat them as being in the EU to be on the safe side. Basically, if you don’t know if they are in the EU or not, you should treat them as if they were.
That a company (C) has a website that can be accessed from a given county does not mean that the company operates in that country. If C is located in country A, markets and advertises to country A, offers products designed to appeal in country A, has its site only in the primary language of country A, uses servers located in country A, and has all its assets and physical offices in country A, it is not operating in country X, even if a few people from X do business with C over its web site. Country X may have laws which claim to apply to C or its web site. It will find it hard to enforce those laws, particularly if owners and officers of X do not travel to X. It will find it hard to extradite anyone for violations of the laws of X unless those actions are also crimes under the laws of A. If X is a major, powerful country such as the US, the UK, or the EU it may be able to get A to enforce its court orders, or to use its influence over the banking system to impose penalties on C. If X is North Korea, or even Brazil, it is probably out of luck. Thus the management of C needs worry primarily about the laws of A, and to a lesser extent the laws of major countries that make some effort to enforce their laws outside their own borders, such as the GDPR, or certain US laws. It probably has little reason to worry about the laws of other countries. If A is itself a major country that can easily resist any pressue from X, C has even less reason to worry. If C does significant business in countries D and E, and particularly if it opens physical offices in D or keeps assets in E, it will have much more reason to worry about the laws of D and E. If it does advertising in the D &amp; E markets, this also gives C more reason to be concerned with their laws. There is always some risk of X finding a way to enforce its laws, but the risk is small.
If you are charged under the laws of Estonia (or Australia or Thailand or the UK) then the laws of the USA have no relevance whatsoever. It makes no difference if you are a US citizen, if the alleged crime happened in the USA or was perpetrated against the USA. If nation X has jurisdiction then you are tried under the laws of nation X. That is what sovereignty means. As to your specific example, Facebook does business in Estonia, therefore they are subject to Estonian law, as a US corporation they are also subject to US law and the law of every other jurisdiction they operate in (see why they need big legal departments?). If a legitimate Estonian warrant was served on them to disclose metadata or anything else then they are legally obliged to do so or be in contempt of court. Oh, and by the way, the first amendment right to free speech does not give you a right to anonymous free speech.