Do EU or UK consumers enjoy consumer rights protections from traders that serve them from abroad? Bob lives in Manchester, or alternatively in Lyon. He purchases a product or service from a vendor in the USA, or perhaps Timbuktu. Do European or British consumer rights legislations bind the American/Malian trader to protect Bob, as the GDPR would?
In theory, what Dale says. However, in practice: Nope, and that's why the trader is in Timbuktu. And I apologize profusely to the Malian people, I have every reason to think it is a fine country in which citizens obey international laws and honor claims, unlike certain other countries. In anglo/Five Eyes nations, Timbuktu tends to simply be used as a metaphor for &quot;a country far, far away and different in its ways than us&quot;. If Bob is regularly buying things in the USA or Timbuktu, then either Bob works for Aperture Science and is using portals, or more likely Bob is using mail order. And now, we get to the nut of it. Most mail order sales are done by mail-order sellers who deal in volume. Those people choose their jurisdictions and venues carefully. And they have help. Do European or British consumer rights legislations bind the American/Malian trader to protect Bob, as the GDPR would? No! That's WHY they're in Timbuktu! (or, wherever they actually are; generally behind what I'll call the Red Curtain.) The point of being there is to be untouchable by civil action or government penalty due to that government's non-enrollment in international agreements, and outright obstruction of such actions. Yes, they and their legal team have crunched the question of &quot;what happens when a European or Briton sues us? What happens when an Anglo or EU government tries to action us?&quot; Their companies are structured so they slough those off at minimal real loss. Ever notice how many sellers have a company name that looks like they rolled their face across a keyboard? That's a sockpuppet shell company, and they have thousands of them. If their other layers of defense fail, they simply fold that company and create another. Their government lets them do this, because they chose jurisdictions wisely. A huge fraction of mail order sales are done on this basis, typically through web sites which purport to be &quot;only a marketplace connecting buyers to sellers&quot;... even though some of those marketplaces also provide warehousing and shipping services to the third party (&quot;only a warehouse&quot; and &quot;only a drop-ship firm&quot;)... and even though they are known for selling their own products, and use the smallest text on the page to mention that this particular item is from a third party. Not mentioning any names. This type of &quot;be fully complicit in selling junk, while the seller of record hides behind the Red Curtain and uses arrays of shell companies to limit exposure&quot; has become systemized in much of the mail order world. Another scheme I've seen is to trick American consumers into being the seller of record; these people end up &quot;holding the liability bag&quot;, and are typically not insured and not collectible in any practical way. Of course you have lovely companies like Eaton, Midnight Solar, Harsco Rail, Roshel, ILSCO, etc. who will meet GDPR simply because it's the right thing to do, even if they don't have feet on the ground inside the EU or UK against which those governments might action. But nobody asks if they're subject to GDPR, do they?
Foreign citizens are just as entitled to Fourth Amendment protections against search and seizure as American citizens are. The case you cited was, in fact, a South Korean citizen who successfully had evidence suppressed from an unjustified border search.
Its just free enterprise, right? Well ... except when there is a law that says its not allowed. I am unfamiliar with Indian law but the relevant law in Australia is the Trade Practices Act which deals with this under the category of Misuse of Market Power. In a nutshell: A business with a substantial degree of power in a market is not allowed to use this power for the purpose of eliminating or substantially damaging a competitor or to prevent a business from entering into a market. By preferring their products over a competitor's in their search engine they are "... eliminating or substantially damaging a competitor ...".
Please note that I'm not a lawyer. If you need specific legal advice, please consult a qualified attorney. Every time someone buys an item from someone else, there's at least an implied contract of sale where the seller of the item agrees to give the buyer the item to be purchased in exchange for a sum of money or other object of value which the buyer agrees to pay as consideration. Generally, in an online purchase, a contract of sale is completed when payment is made and the product has shipped. If the seller fails to provide the item you intended to buy after you make your payment, that's a breach of this contract of sale as the seller has failed to execute their end of the contract. I seriously doubt a "no refunds" policy would excuse the vendor for breaching the contract of sale. If you cannot resolve the issue with the vendor, then your best bet is to initiate a dispute through your credit/debit card issuer.
There is nothing extraterritorial about these laws. If a company sells a good or provides a service to individuals based in the EU, then this good or service has to comply with EU laws. This concept is self-evident for physical goods that are produced anywhere in the world and then sold in the EU and the GDPR just applies this concept to services provided over the internet. The same legal concept also holds in all other major jurisdictions. The only thing that makes this more complicated for the GDPR is the actual enforcability of these laws but that is a technical issue not a legal one.
A slogan such as &quot;The Stripe of Bitcoin&quot; might well be taken to indicate that the seller of a product or service is trading on the good reputation associates with the mark &quot;stripe&quot;. If so, that would probably be a form of trademark infringement, assuming thst &quot;Stripe&quot; is protected as a trademark, unless the permission of the holder of the trademark &quot;Stripe&quot; was obtained. Payment processing and cryptocurrency handling are sufficiently closely related that customer confusion is possible. Note that competitive use is generally permitted. One can, for example market a soft drink with the tag &quot;The cola that's better than Coke&quot; without permission from Coca-cola (which i doubt anyone would ever get). This is because when a marketer says &quot;X is better than Y&quot; no one reasonably thinks X is sponsored or approved by Y, nor will anyone be lead by this tag into thinking that X and Y are the same. Other forms of nominative use are also allowed without permission from the trademark holder. For example, a computer component might have been advertised as: &quot;compatible with Intel Pentium&quot;, as this is just using a trademark to name a related product, and does not imply affiliation or sponsorship. But a tag such as &quot;The Rolls-Royce of pencils&quot; might be ruled to be infringing, even though Rolls does not, as far as I know, make pencils. Note that the details of trademark law vary significantly from one country to another. Note further that trademarks protected in one country may not be protected in another. The question does not specify any jurisdiction, so no answer can refer to the particular country that the asker may have in mind.
If GDPR applies, then no one can opt out. If it doesn't apply, then an IP block is superfluous. Whether GDPR applies is determined by Art 3 GDPR. For this, we must distinguish where the data controller is operating from. It is irrelevant where the site is hosted, but primarily relevant where the data controller (your colleague) has an “establishment”, e.g. where he resides or typically works from. Per Art 3(1), GDPR applies to all processing activities in the context of an European establishment, regardless of where the users are. So if your colleague were running this site from Europe, they wouldn't be able to circumvent GDPR by blocking European users. However, if your colleague is running this site from outside of Europe, then Art 3(1) doesn't trigger. Per Art 3(2), GDPR can apply to processing activities where there is no European establishment. There is the Art 3(2)(a) “targeting criterion”: if your colleague “offers” goods or services to people who are in Europe, regardless whether paid or gratis, then GDPR applies to all processing activities related to this offer. I'll discuss this more below. There is also the Art 3(2)(b) criterion: if your colleague monitors the behaviour of people that occurs in Europe, then GDPR applies. For example, an app collecting geolocation information or a website creating interest profiles for ad targeting might trigger this criterion. An IP block can help to establish that no offering/monitoring related to people who are in Europe is happening, but it might not be necessary. It may be worth talking a bit more about the targeting criterion. The GDPR explicitly says that mere availability of a website in Europe doesn't imply that GDPR would apply. Instead, it is necessary to establish the data controller's intention – are they soliciting users from Europe, or otherwise expecting that people from Europe might use those services? Recital 23 gives a couple of non-exhaustive factors that can be considered here, for example: the site uses a language or currency used in the EU but not used in the controller's own country the site mentions users or customers from Europe, e.g. in testimonials This means that a lot of US websites, written in English or Spanish, only mentioning payment in USD (if any), not mentioning any European countries, will not be subject to GDPR. Then, occasional European visitors are irrelevant. It wouldn't be necessary to IP-block potential European users. However, such an IP-based block would help establish that the data controller really doesn't intend for those services to be offered to people who are in Europe. My personal opinion is that it's wasted effort to block users from foreign countries in case their foreign laws claim to apply, but if such a block brings peace of mind that might be worth it. While geoblocking might not be necessary, is it sufficient? There is no clear guidance on this subject, but it seems to be generally accepted that IP-based geoblocking is fine, even though it is trivially circumvented using VPN services. Of course, if a website were to block European IP addresses but were to also advertise that people in Europe can use their services via VPNs, that would probably still be an “offer” and might defeat the point of doing any geoblocking. The Art 3(1)(a) targeting criterion is most easily applied to things like ecommerce where physical goods are shipped to the customer in return for payment – so essentially whenever the data controller participates in the EU Single Market. This is roughly similar to the concept of a Nexus in US tax law. But in principle the targeting criterion can also apply to other kinds of websites or apps such as blogs, even if they are gratis. GDPR does not just apply to for-profit commercial activity, and doesn't distinguish between controllers that are entities/LLCs and controllers who are natural persons. Things are slightly more complicated due to the Art 3(2)(b) monitoring criterion and the pervasive use of online trackers on websites, but this aspect of the GDPR is difficult to enforce and frequently ignored. In this answer, “Europe” means the European Union (EU), the European Economic Area (EEA), and the United Kingdom (UK). Note that countries like Norway are covered by GDPR, whereas Switzerland is not. Of course, the GDPR is not the only privacy law relevant internationally.
That a company (C) has a website that can be accessed from a given county does not mean that the company operates in that country. If C is located in country A, markets and advertises to country A, offers products designed to appeal in country A, has its site only in the primary language of country A, uses servers located in country A, and has all its assets and physical offices in country A, it is not operating in country X, even if a few people from X do business with C over its web site. Country X may have laws which claim to apply to C or its web site. It will find it hard to enforce those laws, particularly if owners and officers of X do not travel to X. It will find it hard to extradite anyone for violations of the laws of X unless those actions are also crimes under the laws of A. If X is a major, powerful country such as the US, the UK, or the EU it may be able to get A to enforce its court orders, or to use its influence over the banking system to impose penalties on C. If X is North Korea, or even Brazil, it is probably out of luck. Thus the management of C needs worry primarily about the laws of A, and to a lesser extent the laws of major countries that make some effort to enforce their laws outside their own borders, such as the GDPR, or certain US laws. It probably has little reason to worry about the laws of other countries. If A is itself a major country that can easily resist any pressue from X, C has even less reason to worry. If C does significant business in countries D and E, and particularly if it opens physical offices in D or keeps assets in E, it will have much more reason to worry about the laws of D and E. If it does advertising in the D &amp; E markets, this also gives C more reason to be concerned with their laws. There is always some risk of X finding a way to enforce its laws, but the risk is small.