Do non-US companies have to pay US tax just because they have US customers? I just came across some US tax forms for foreign entities like W-8BEN-E and 1040NR which made me ask this question. Suppose a company called Cool Stuff Ltd. runs some sort of online business serving customers all over the world. This could be paid content subscriptions, dating, posting ads/classifieds, hosting, VPN — all sorts of stuff that is performed by software accessible by customers over the Internet. The company is not present in the US in any way: no incorporation, no offices, no employees, no web hosting, the shareholders and directors are not related to the US at all. People in the US can access the company's website/app and buy services in the company's home country currency. The company may not even care or take note of where they are from. Technically, if any single John Doe from the US decides to buy a subscription, he will make the company "receive" "income" "from U.S. sources that consists of" "Compensation for, or in expectation of, services performed" (W-8BEN-E): Does that really trigger the company's obligation to fill US tax forms and pay tax in the US? If so, is there any threshold i.e. minimum income that triggers the obligation?
It is more complicated. From Wikipedia “The United States has income tax treaties with over 65 countries. These treaties reduce the chance of double taxation by allowing each country to fully tax its citizens and residents and reducing the amount the other country can tax them. Generally the treaties provide for reduced rates of tax on investment income and limits as to which business income can be taxed. The treaties each define which taxpayers can benefit from the treaty.”
International organizations such as the UN are typically treated similar to foreign governments, and thus enjoy various privileges. One consequence is that typically, income from employment by these organizations is not subject to taxation by the host countries where the employee lives or carries out their work. However, the details depend very much on the tax laws in that host country. The employee might still be required to file taxes, but would then likely be able to declare the income as tax-free under the corresponding provision of the national tax law. This usually also depends a lot on the treaties which created the international organisation. For example, the Convention on the Privileges and Immunities of the United Nations contains an explicit tax exemption for UN officials, though not necessarily for regular employees. As an example for how a country treats employees of international organization, the IRS has guidance regarding US tax law here. Other countries tend to have similar rules, albeit with less accessible online documentation :)
Yes, non-US citizens can own equity in US companies. To be specific: You do not have to be a citizen or resident of the US to own securities in a company incorporated in the US.
What are our possibilities here? You could be sued for damages in Mexico, the country of origin of the copyright or any of the other signatories of the Berne Convention. You could also be charged with a criminal offence but that is less likely. how much can we get away with? Not a legal question. What you are proposing is illegal - how likely your getaway plan is to work is not for me to say. Is there any advantage on us being on México? No Is there any advantage on picking any either Dragon Ball or League of legends because of the country they are in? No Can they stop us from doing it? Yes
Yes, you could do this be means of the EULA, provided you are not in the EU yourself. You only have to comply with the GDPR if you are offering a product or service to people that are in the EU. If you are making it clear that whatever you offer is not available to Europeans, you make your site exempt from the GDPR.
Sure, you can. But if you, from the US, contract with and pay someone outside the US and then use the results of that effort - the reverse-engineered code, either directly in violation of copyright or to find workarounds - within the US, you may not be culpable in a criminal sense (depending on different jurisdictions and trade/IP agreements), but you certainly would be liable in a civil sense. If the US based software developer (I assume a US-based software company, as you said "outside the US") tracks you down, they can open a civil action against you for any damages they want to claim, including theft of IP, loss of profits, EULA violations, and on and on, because you posses and are using reverse engineered code. How much money do you have to lose?
Yes, it triggers the GDPR obligations Considerations: Can you surely identify those residing in Europe? In that case you should ask them to sign up again and confirm the consent. A lot of mailing lists are doing just that. Did they previously give consent and you can document it? If so, then you can argue that you have the required consent. Do you have business in Europe? If not then I don't think they would bother to go after you. You could just walk away from the fine. What other personal informastion are you storing? If you know who reside in Europe then you already have more info than just the email. The email address itself wouldn't be much of a documentation issue, SAR or Portability task.
Not legal advice - you should consult an attorney who knows your local jurisdiction. That's a general statement, but especially true here because the GDPR does not include personal liability for directors (or others) in the event of a data breach, but domestic laws may indeed do just that. The UK is one example where certain circumstances can lead to criminal liability for directors of a firm in the event of a breach. That said, your company should care. The fines for knowingly allowing a breach or not reporting it properly in a timely manner have been made more significant than the prior Directive. There are things you could do to potentially mitigate consequences in the event of a breach and a fine being levied on the company, such as aligning with best practices and getting certifications. In sum, the actual punishments for noncompliance will vary by jurisdiction, but any business that handles data in the EU should undoubtedly be ensuring it is aware of what, if any, obligations it has and taking steps to comply before May's deadline.