Is it legal to work for a foreign company you own that has no entity in the USA As the question stipulates. If a US citizen living in the USA wants to work for a foreign company he owns and that has no US entity. Is this legal? He would basically be in a situation where he's doing everything as if he were residing in that foreign country but simply residing in the USA. I know that the US consider taxable income to be income generated on american soil. So filing taxes in the US would be a requirement. But is the setup even legal? Or is it an obligation for the foreign entity to open a US entity and pay through it?
You are mistaken: The U.S. governments (both federal, and states that impose income tax) assert a right to tax both: Income earned within their jurisdiction (e.g., "on their soil"), and Income earned by citizens (or residents, in the case of states). So it is perfectly legal for a resident U.S. citizen to operate a foreign business entity, earn profit, pay himself, and even bank the money overseas. However, a resident in such a situation would be in violation of tax law if he failed to report his interest in the foreign entity and his earnings, as prescribed by the IRS, on his tax filings.
Links are in French. As the author of a work, you would generally hold copyright unless there's a contract otherwise. L113 of the Code de la propriété intellectuelle determines who is the rights holder of a given work and I don't see anything there that changes things for you as a contractor. Even if you assigned some rights to your employer through a contract, France has moral rights which can never be ceded. In fact, even if you were a salaried employee, you still hold the rights by default, unlike the US. There are a few exceptions to that though: software, inseparable joint works, and works where the creative process was purely directed by your superiors.
what taxes or fees does he need to pay? According to this glimpse of Austrian tax law, Franz would still have to pay income tax on any non-monetary compensation he gets from the company. See section of "Vermietung und Verpachtung [...]". Non-monetary compensation is typically known as benefits. The term serves to distinguish that compensation from (1) any cash flows from the company to Franz, which you ruled out in your description, and (2) any expenses the company incurs for business purposes involving Franz. Your mention that "nor does he take money out of the company in any other way" might mean that you ruled out benefits as well. I just wanted to be safe and preclude any misunderstanding in case you had in mind only cash flows from the company to Franz.
The territorial scope of the GDPR is defined in Article 3. It covers "personal data of data subjects who are in the Union", whether they are EU citizens or not. So to answer your questions: 1) are EU users, but moved to USA a few years ago, and signed-up on my website? They are not in the EU, so are not covered. You don't need to know if someone is an EU citizen, just if they are currently in the EU. 2) went for holidays in USA, signed-up on my website, and then came back to EU? (note - potentially skipped any Consent questions at sign-up, because IP was from USA) If someone moves into the EU while using your service then they fall under the GDPR for the time they are in the EU. If their home address is in the EU then that is covered, and monitoring of their behaviour while in the EU is also covered. Your other two questions are about VPNs. If a VPN is used to evade IP address geolocation and you have no other clue about where someone is then you can't be blamed for not knowing where they are (although I'm not aware of any actual case law on this topic). But if someone with a USA IP address gives a home address in the EU then you should probably treat them as being in the EU to be on the safe side. Basically, if you don’t know if they are in the EU or not, you should treat them as if they were.
In business dealings, you would have a contract with a company, not with its owner. The new owner inherits both the assets and liabilities of the company. It's up to the buyer of the business to do due diligence before buying the company. The old owner may escape obligations to clients and suppliers once the sale of the business is complete, but the new owner could sue the old owner for fraud. (It may be possible to escape some liabilities by declaring bankruptcy, but that's not the situation you described. One unethical accounting trick that a company can use is to split the company into two corporations such that one branch inherits the liabilities, and it go defunct.)
That is private. Who you work for is not information that is disclosed publicly by any state actor in Germany, just like your taxes. In fact, that or who you are employed at is often regarded as personal and private information. Nigh impossible through agencies Public agencies like the Fiskus (tax), Agentur für Arbeit, and immigration are not allowed to give any information about a person to anyone but that person or another agency that has the right to that information. Yes, (generally speaking) the tax office may not even say that a person exists (or doesn't) and what their tax number is to anyone but the person in question.
Like many US legal questions, there is a Congressional Research Service report about this. It is not generally a violation of US law to do things in another country where the only connection with the US is that the offender is a US citizen. However, there are a number of general situations where the US has jurisdiction over federal crimes if either the victim or offender is a US citizen: if a place isn't within the jurisdiction of any country (e.g. Antarctica); a place used by a US government entity (like an embassy or airbase); crimes by American soldiers and those employed by or accompanying the military; etc. These are considered to be within the special maritime and territorial jurisdiction of the US. Other laws apply if they say so. For instance, any US national committing war crimes inside or outside the US can be punished under US law; ditto for treason. The Foreign Corrupt Practices Act makes it illegal for a US national to bribe a foreign official anywhere outside the US for business reasons (if it's inside the US, there are more requirements). For instance, you aren't allowed to pay kickbacks to a foreign government's acquisition officer to buy your product. The CRS report has more (it doesn't include the FCPA, but that appears to be an oversight). Note that extraterritorial jurisdiction doesn't just apply if the person is a US national. US laws can also confer it if the victim is a US national, if the offense has a significant US component, if it's directed towards the US, if it's in violation of international law and the offender later turns up in the US, etc. For your scenarios: Dual citizenship doesn't matter. A US citizen is a US citizen, and is required to obey all laws that apply to US citizens, unless those laws explicitly exempt dual citizens. A dual citizen isn't treated differently by the government; as far as the US government is concerned, their US citizenship is all that matters (except for certain specific purposes like security clearances). In Kawakita v. United States, a US-Japanese dual citizen was convicted of treason against the US for aiding Japan in WWII. Depends. Plenty of these laws have no requirement that anything related to the crime actually happen in the US; for sex tourism, the subsection about traveling in foreign commerce for the purposes of engaging in illicit sexual conduct is followed by a subsection about engaging in illicit sexual conduct in foreign places. "Travel with the purposes of X" or "with intent to X" means you must have intended to do X at the time you traveled, but most extraterritorial laws don't control travel with intent to X (they cover X directly). Depends on the law. Some laws (like child sex tourism) apply to any permanent resident of the US as well as any citizen. Some apply to anyone, because they're based on a conspiracy started in the US. Others apply just to US nationals; a noncitizen isn't bound by them (for instance, no one but a US national can be charged with treason against the US, for obvious reasons). Still others apply to anyone who later turns up in the US, even if that is literally the only connection between the US and the offense (this is basically reserved for crimes against international law, like genocide).
Per Art 3(2), GDPR only applies to non-European companies when their processing activities relate to the offering of goods or services to people in Europe, or when the processing activities relate to monitoring people in Europe. However, the word “offer” of this targeting criterion requires some level of intent. It is not enough for GDPR to apply that they're marketing to someone who happens to be in Europe, but GDPR would apply if they are intentionally marketing to people who are in Europe. I don't know what they are marketing, so I don't know if that would be the case here. Even if GDPR were to apply, it would not be the most appropriate law. Yes, there's the GDPR right to erasure, which applies under some conditions (though there's a pretty absolute right to opt-out from marketing). The EU's ePrivacy Directive provides more specific rules though, in particular that every such marketing email must offer a way to unsubscribe. Other countries have comparable anti-spam laws, potentially also the home country for this online service.