The EU General Data Protection Regulation (GDPR) applies to companies established anywhere in the world that offer goods or services to, or monitor the behaviour of, individuals located in the EU (Article 3(2)). Stefano Saluzzo's 2019 analysis of the principle of territoriality in EU data protection law concluded that these jurisdictional triggers are best classified as territorial extension rather than genuine extraterritoriality, but left four linked issues unresolved, which bear on whether this jurisdictional claim is internationally legitimate and practically effective: (1) the targeting criterion's 'intention' element remains undefined beyond Recital 23's non-exhaustive examples; (2) the GDPR imposes its full, undifferentiated obligations on extra-EU controllers with no safeguard clause, straining the international-law principle of proportionality; (3) enforcement against non-cooperative third-country controllers is structurally weak; and (4) the GDPR does not resolve how its territorial scope interacts with other states' concurrent jurisdictional claims over the same processing. The post-2019 literature — European Data Protection Board (EDPB) soft law, Court of Justice of the EU (CJEU) case law on the right to be forgotten, and scholarship through 2026 — leaves all four questions open: the operative interpretation of Article 3(2) remains a non-binding, factor-based EDPB guideline that the CJEU has never endorsed for that provision; no safeguard or differentiation mechanism has been adopted; supervisory authorities still publicly decline to act against uncooperative foreign controllers; and the conflict-of-laws problem persists while the same targeting trigger has been replicated in the Digital Services Act and the AI Act, the EU's later platform-regulation and artificial-intelligence laws. The problem asks for a doctrinal and policy framework: determinate targeting criteria, a proportionality-based design of differentiated obligations, workable enforcement mechanisms, and conflict rules for concurrent jurisdiction.

Background

EU data protection law owes its global reach to Article 3 of the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), the EU law governing all processing of personal data — information relating to an identified or identifiable person — by a 'controller' (the entity determining the purposes and means of processing) or 'processor'. Article 3(1) applies the Regulation when processing occurs in the context of a controller's or processor's 'establishment' in the EU, a concept the Court of Justice of the EU (CJEU) reads broadly (in Google Spain, Case C-131/12, a national advertising-sales subsidiary sufficed). Article 3(2) goes further: it applies the GDPR to controllers with no EU establishment at all when they process personal data (a) in relation to the offering of goods or services to data subjects — the individuals to whom the personal data relates — who are in the Union, or (b) for the monitoring of such data subjects' behaviour as far as it takes place within the Union. Recital 23 lists non-exhaustive indicators of 'offering' — such as use of EU languages or currencies, or reference to EU customers — and states that mere accessibility of a website from the Union is not enough. In public international law, such a provision is an exercise of 'prescriptive jurisdiction', a state's authority to make its law applicable. The classical jurisdictional bases are territoriality, nationality, protective and universal interests, and the contested passive-personality principle (protecting one's nationals abroad); the effects doctrine covers conduct abroad with substantial effects at home. Article 3(2) is widely analysed as a 'targeting' or destination-based criterion: jurisdiction attaches where the offer or the monitored behaviour is located in the Union. Commentators distinguish 'territorial extension' — jurisdiction grounded in a territorial link but shaped by conduct or circumstances abroad — from genuine extraterritoriality, in which no territorial link exists; the distinction matters because international law scrutinises the latter far more strictly, and because even a permissible basis must be exercised proportionately, balancing the regulating state's interests against those of other states. Before the GDPR, Svantesson (2015) identified the targeting criterion as the 'weak spot' of EU data privacy law precisely because its content is undefined; Gömann (2017) and De Hert and Czerniawski (2016) debated whether Article 3's triggers are genuinely territorial; and Brkan (2016) showed that data protection's extended scope sits uneasily with conflict-of-laws methods for deciding which state's law governs. Saluzzo's 2019 chapter systematised the debate: the GDPR's jurisdictional claims are territorial extensions anchored to Union territory, but their international legitimacy and practical effectiveness are not secured. Three structural features of the GDPR frame what remains unresolved. First, a controller subject only to Article 3(2) must designate a representative in the Union (Article 27) as the contact point for supervisory authorities — often the only enforcement hook. Second, enforcement is decentralised across the national data protection authorities (DPAs) of the Member States — coordinated by the European Data Protection Board (EDPB), an EU-level body whose guidelines are non-binding soft law — and the tools for reaching defendants outside the EU are weak. Third, the GDPR contains no clause limiting or differentiating the obligations of extra-EU controllers, whereas other EU regimes with extended reach (for example in financial regulation) include equivalent-protection or scope-limiting safeguards. The unresolved question is whether this design can be made determinate, proportionate, enforceable, and compatible with the concurrent data protection laws of other states.

Problem Statement

Determine whether, and under what conditions, the EU's exercise of prescriptive jurisdiction through Article 3(2) GDPR can be made determinate in application, proportionate under international law, effectively enforceable, and compatible with the concurrent jurisdiction of other states - and, where the current design fails these tests, specify what interpretation or reform would cure the failure. The four questions are linked aspects of one objective, the international legitimacy and practical effectiveness of the GDPR's territorial extension. Concretely: (1) Targeting criteria - develop and justify operational criteria for when a controller 'envisages' offering goods or services to, or monitoring the behaviour of, data subjects in the Union, settling the meaning of the intention requirement beyond the non-exhaustive examples listed in Recital 23 of the GDPR, the preamble provision whose illustrative targeting indicators include EU languages, currencies, and customer references (Does multilingual presentation suffice? Is a service offered only outside the EU but not withdrawn when a user enters the EU covered? When do tracking technologies constitute 'monitoring'? Is mere accessibility never enough?), such that Member State authorities and courts can apply them consistently. (2) Proportionality safeguards - specify what differentiation of obligations, or safeguard mechanism limiting the obligations of extra-EU controllers, the international-law principle of proportionality requires, and whether the GDPR's undifferentiated imposition of the full obligation set on EU and extra-EU controllers alike can be justified. (3) Enforcement - identify and design legally workable mechanisms for enforcing EU data protection law against third-country controllers that fall under Article 3(2) but refuse to cooperate. (4) Concurrent jurisdiction - elaborate conflict rules or comity criteria - principles of deference among states whose laws concurrently claim the same processing - for situations in which the GDPR's territorial scope overlaps with the data protection laws of third states claiming application to the same processing, resolving the conflict-of-laws problem that the GDPR itself does not address.

References

  1. Stefano Saluzzo, 'The Principle of Territoriality in EU Data Protection Law', in Tommaso Natoli & Alice Riccardi (eds.), Borders, Legal Spaces and Territories in Contemporary International Law, Springer, 2019, pp. 121-141. DOI: 10.1007/978-3-030-20929-2_5, https://doi.org/10.1007/978-3-030-20929-2_5
  2. European Data Protection Board, Guidelines 3/2018 on the territorial scope of the GDPR (Article 3), Version 2.1, 12 November 2019. https://www.edpb.europa.eu/system/files/documents/files/file1/edpb_guidelines_3_2018_territorial_scope_after_public_consultation_en_1.pdf
  3. European Data Protection Board, Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR, Version 2.0, adopted 14 February 2023. https://www.edpb.europa.eu/system/files/documents/2023-02/edpb_guidelines_05-2021_interplay_between_the_application_of_art3-chapter_v_of_the_gdpr_v2_en_0.pdf
  4. Dan Jerker B. Svantesson, 'Extraterritoriality and targeting in EU data privacy law: the weak spot undermining the regulation', International Data Privacy Law 5(4), 2015, pp. 226-234. DOI: 10.1093/idpl/ipv024, https://doi.org/10.1093/idpl/ipv024
  5. Merlin Gömann, 'The new territorial scope of EU data protection law: Deconstructing a revolutionary achievement', Common Market Law Review 54(2), 2017, pp. 567-590. DOI: 10.54648/cola2017035, https://doi.org/10.54648/cola2017035
  6. Maja Brkan, 'Data protection and conflict-of-laws: A challenging relationship', European Data Protection Law Review 2(3), 2016, pp. 324-341. DOI: 10.21552/EDPL/2016/3/8, https://doi.org/10.21552/EDPL/2016/3/8
  7. Paul De Hert & Michal Czerniawski, 'Expanding the European data protection scope beyond territory: Article 3 of the General Data Protection Regulation in its wider context', International Data Privacy Law 6(3), 2016, pp. 230-243. DOI: 10.1093/idpl/ipw008, https://doi.org/10.1093/idpl/ipw008
  8. Benjamin Greze, 'The extra-territorial enforcement of the GDPR: a genuine issue and the quest for alternatives', International Data Privacy Law, 2019. DOI: 10.1093/idpl/ipz003, https://doi.org/10.1093/idpl/ipz003
  9. Oskar Josef Gstrein & Andrej Janko Zwitter, 'Extraterritorial application of the GDPR: promoting European values or power?', Internet Policy Review 10(3), 2021. DOI: 10.14763/2021.3.1576, https://doi.org/10.14763/2021.3.1576
  10. Uta Kohl, 'The Long-Arm of the GDPR and its Inherent Weakness - The EDPB's Guidelines 05/2021 on the Interplay of Article 3 and Chapter V of the GDPR', SSRN Working Paper, 2022. DOI: 10.2139/ssrn.4027796, https://doi.org/10.2139/ssrn.4027796
  11. Christopher Kuner, 'Territorial Scope and Data Transfer Rules in the GDPR: Realising the EU's Ambition of Borderless Data Protection', SSRN Working Paper, 2021. DOI: 10.2139/ssrn.3827850, https://doi.org/10.2139/ssrn.3827850
  12. Michal Czerniawski & Dan Svantesson, 'Challenges to the extraterritorial enforcement of data privacy law – EU case study', in Dataskyddet 50 år: Historia, aktuella problem och framtid, Stiftelsen Juridisk Fakultetslitteratur, 2024, pp. 127-154. DOI: 10.53292/bd1fa11c.f5b3afbe, https://doi.org/10.53292/bd1fa11c.f5b3afbe
  13. Dan Jerker B. Svantesson, 'Article 3 Territorial scope', in The EU General Data Protection Regulation (GDPR): A Commentary, Oxford University Press, 2020, pp. 74-99. DOI: 10.1093/oso/9780198826491.003.0005, https://doi.org/10.1093/oso/9780198826491.003.0005
  14. Dan Jerker B. Svantesson, 'Scope of jurisdiction online and the importance of messaging - lessons from Australia and the EU', Computer Law & Security Review, 2020, Article 105428. DOI: 10.1016/j.clsr.2020.105428, https://doi.org/10.1016/j.clsr.2020.105428
  15. Ioanna Hadjiyianni, 'The Global Reach of EU Law in the Digital Age: The Territorial Scope of Data Protection', in EU Internet Law in the Digital Single Market, Springer, 2021, pp. 311-335. DOI: 10.1007/978-3-030-69583-5_13, https://doi.org/10.1007/978-3-030-69583-5_13
  16. Jure Globocnik, 'The Right to Be Forgotten is Taking Shape: CJEU Judgments in GC and Others (C-136/17) and Google v CNIL (C-507/17)', GRUR International 69(4), 2020, pp. 380-388. DOI: 10.1093/grurint/ikaa002, https://doi.org/10.1093/grurint/ikaa002
  17. Yuliya Miadzvetskaya & Geert Van Calster, 'Google at the Kirchberg Dock. On Delisting Requests, and on the Territorial Reach of the EU's GDPR (C-136/17 GC and Others v CNIL, C-507/17 Google Inc v CNIL)', European Data Protection Law Review 6(1), 2020, pp. 143-151. DOI: 10.21552/edpl/2020/1/20, https://doi.org/10.21552/edpl/2020/1/20
  18. Svetlana Yakovleva, 'GDPR Transfer Rules vs Rules on Territorial Scope: A Critical Reflection on Recent EDPB Guidelines from both EU and International Trade Law Perspectives', European Law Blog, 9 December 2021. DOI: 10.21428/9885764c.5451c22e, https://doi.org/10.21428/9885764c.5451c22e
  19. Felix Bieker, 'Schroedinger's data: SRB and the Digital Omnibus', European Law Blog, 20 January 2026. DOI: 10.21428/9885764c.25fc449c, https://doi.org/10.21428/9885764c.25fc449c