By what mechanism does GDPR jurisdiction bind data controllers that operate outside the EU? If you process the data of data subjects resident in the EU then you are supposed to be bound by the GDPR no matter where you are located. Why care what the GDPR says if you don't have a presence in the EU?
Because most countries enforce foreign judgements You get prosecuted in the EU and have a fine imposed. If you have no assets in that jurisdiction they give the judgement to a court in your jurisdiction which issues a local judgement and seizes your assets.
That GDPR Disclaimer is no protection in some jurisdictions: the applicable laws to that situation in germany for example don't care about the GDPR: Cold calling, mailing, or e-mailing private people to advertise services all is handled by the same law: Without the consent it is expressly illegal under §7 of the law against unfair competition (Gesetz gegen unlauteren Wettbewerb UWG) and such cases are rather Slam-Dunk if the origin can be made out. The punishment can be a 300.000 € fine. The fact that to email someone you need their e-mail address and that e-mail addresses and private addresses are by default considered personally identifiable information is making it worse for the advertizer: Without either an exception (there is none available to cold-emailing) or special allowance of the person the data belongs to, you violate §4 of the federal data protection law (Bundesdatenschutzgesetzes BDSG) just by handling their e-mail address. That's a separate crime from the UWG one, adding up to another 300.000 € fine under §43 BDSG - or even up to 2 years in prison under §44 BDSG! Oh, and if the email does not contain a proper sender's address, that's another chance for a huge fine under the UWG... So, GDPR is your least trouble, if you violate the marketing laws of a country, or their own data privacy laws. A disclaimer means nothing as the act of sending the mail, even to an unintended addressee, is what is illegal and the law as written does not give a damn about 'I didn't want to advertise to that person' when in fact you sent them unwanted advertisements. Oh, and the very repository you suggest? It would violate the very same §4 BDSG and be illegal for processing private data if it was not actively asked to do that by the end user. As a result, that database is useless: It does kick back all people not in its database. Its database is incomplete because only few people give their address to that database as people not aware of the database never add their data on their own. So it regularly violates §4 BDSG with every German citizen's e-mail address it gets and kicks back, and claiming those addresses would be OK, it throws the company trying to check the database under the bus because they rely on data that is impossible to be reliable. tl;dr Don't do cold-(e)-mail marketing. You throw yourself into boiling oil with a lit torch in hand. further reading Other laws banning such behavior I had listed here, and I quote myself: The US has the CAN-SPAM-Act, which illegalizes sending unsocialised advertisements. You may NOT send a mail if any of the following is true: it has no opt-out the email was gained by 'harvesting' contains a header not matching the text contains less than one sentence the adressee does not have any relation to you In fact, you are liable for a 5-digit fine per infringing e-mail in the US. The FTC itself suggests to never buy e-mail lists - as E-mail harvesting or generating any possible e-mail adress itself is illegal.
The GDPR's right to erasure is not absolute. Simplifying things a bit, you only have this right if the legal basis for processing was consent, because consent can be revoked freely; or the legal basis for processing was legitimate interest and the controller does not have an overwhelming legitimate interest in keeping the data. Legitimate interest always requires that the controller's legitimate interest and the data subject's rights and interests are balanced. A request for erasure shifts this balance but does not decide it. In practice, a request for erasure may be denied if the controller has legal obligations to keep this data, for example financial records; or the continued processing of this data is necessary for performance of a contract; or the controller has an overriding legitimate interest in continued process of the data. Note that contracts may have effects that survive termination of the contract. Note also that a contract might not involve the data subject as a party to the contract, the classic example being a postal delivery contract that necessarily requires processing of the recipient's personal data. In your specific example it seems that the legal basis was legitimate interest and that the data controller has an overwhelming legitimate interest to hold on to parts of your data for the purpose of fraud prevention. If you feel like the continued processing of the data is illegal, for example because the legitimate interest balancing was done incorrectly, or because the legal basis was consent, then you have the following remedies: You can lodge a complaint with the responsible supervisory authority. You can sue the controller before a responsible court for compliance, and for the (actual) damages that you suffered as a result from illegal processing. I'll point out that neither of these approaches is likely to work for you, because abuse/fraud prevention appears like a pretty standard case of overwhelming legitimate interest.
The status of any PII (Personally Identifiable Information) is the same in GDPR regardless of location, or who enters it. Its goals are (among others) to stop any actor (company / government or other) from hiding responsibility about their use and practices around people's data. GDPR does even apply to anything offline and on paper. Basically it means you have to validate any entry field is free of PII before processing it. Or make it clear in your privacy statement how you handle this use-case.
First of all, although the GDPR is stated to apply to any site which processes the data of any person who is in the EU, it is not clear how a site not located in the EU, does not business in the EU, and does not primarily target EU residents as its audience can be required to comply with the GDPR. To the best of my knowledge, no such case has yet been brought, much less decided. There has also been some debate on whether an IP address constitutes Personal Data under the GDPR, and if it always does so, or only under particular conditions. The European Court of Justice (ECJ) held that (under the predecessor Directive 95/46/EC) that a dynamic IP address was personal data. But in that case the web site was run by the German Federal Government, which surely has wider scope for getting info from a German ISP than a small private US web activist does. There is not yet any case law that I know of on the applicability of the GDPR to IP addresses in any case at all similar to the one in the question. Joe would in my view be wise to at least learn that logs are being kept, and post a disclosure of this on the site. Whether Joe needs to do more than that is less than clear at this time.
When you use other services, the question is whether that service acts as an independent data controller, or as a data processor who only uses the data on your behalf. When engaging a data processor they must be legally bound to only use the data on your behalf, for example with a contract / data processing agreement (DPA). See Art 28 GDPR. Data processor status is attractive because processors are seen as an extension of the controller. In contrast, when sharing data with other controllers you would need a separate legal basis to authorize this sharing. Google offers tons of different services, so this question needs to be considered on a case by case basis. For Google Cloud services or Google Workplace, Google generally acts as a data processor. For other services, Google acts as a controller. Notably, Google Fonts does not offer a DPA so that you cannot claim they're acting as a processor in that context, regardless of what other Google services you use. An equally important problem when using Google services is the data transfer problem. Google is controlled from the US, but the US do not offer an adequate level of data protection (see the Schrems II judgement). Comparatively few Google services allow you to select where the servers are located, as to prevent transfers of personal data to countries where privacy cannot be guaranteed. For example, this is why Google Analytics (GA) is problematic. Google acts as a data processor for basic GA features but makes no promises about the location of servers. Thus, using GA implies a (probably) illegal transfer of personal data to the US.
Don't collect or process personal data Many (though of course not all) websites can easily be run without collecting or otherwise processing any personal data. The position of GDPR is that if you are not able to fulfil the basic, simplest core conditions for processing personal data (understanding what you're processing and why and why it's allowed, describing it in a privacy policy, having a non-underage person who's responsible for that) then you are not allowed to process personal data of other people. So don't. Build your website so that any personal data are not collected.
Legal framework Per Articles 4(1) and 4(2) of the UK GDPR, your email address is most likely personal data (and certainly is once you notify the data controller that it belongs to you), and the storage and use of that data constitutes processing. In order to process your personal data, the data controller must establish at least one of the six lawful bases set out in Articles 6(1)(a) to 6(1)(f). It's quite clear that none of those lawful bases apply in this situation. Hence, the processing is unlawful. Next steps Start by making a request to the data controller under Articles 14(1) and 15(1) for the following: A copy of all personal data (including the email address) which they hold in relation to you. The purpose of them holding the data. The legal basis on which they hold the data. That they erase all personal data which they hold in relation to you, pursuant to Article 17(1)(d) (unlawful processing of data). Per Article 12(3), the data controller is required to respond &quot;without undue delay&quot;, with an upper time limit of 1 month (or 2 months if they notify you of the time extension within 1 month). Sadly, most data controllers in my experience seem to interpret this to mean that 1 month is the standard time limit, even though technically this is incorrect and the standard limit is &quot;without undue delay&quot;. Pursuant to Article 12(6) the data controller can pause the clock by asking you for additional information if they have &quot;reasonable doubts concerning [your] identity&quot;. If you send your request from the email address in question then they can't really have &quot;reasonable&quot; doubts, but be aware of this possibility in any case and respond promptly to any requests to confirm your identity so that the clock resumes. Most likely they will be unable to (correctly) provide an answer to points 2 and 3 above, since they do not have a genuine purpose or legal basis. If, after the maximum deadline has expired, they have still not responded and/or erased the data, you have two options: Complain to the ICO under Article 77(1). The ICO has the power under Article 83(5) to fine the data controller up to the higher of 4% of their turnover or £17,500,000. Complaining to the ICO is free and easy and is usually recommended over option 2. Issue a claim in the County Court for a compliance order pursuant to Article 79(1) and Section 167 of the Data Protection Act 2018. You also have the right to claim compensation for &quot;material and non-material damage&quot; (including distress) pursuant to Article 82(1) and Section 168, but this may be unrealistic in the case of a few unwanted emails. Option 2 is not free: you will need to pay a court fee and, unless you represent yourself, legal fees. There may also be additional cost risks if you lose the case. Mentioning the above two points in your request could be an effective way to persuade them to comply in the first place.