International Privacy for US Businesses: GDPR, UK, Canada and Website Tracking

Lakeshore Outfitters is an invented company with 85 employees and $38 million in annual sales. It makes camping gear in the United States and sells it online. A buyer in Munich orders a tent. A Toronto retailer wants to stock the line. A reseller in Montreal asks for a data processing agreement. Nobody at Lakeshore has an office abroad, so the owner assumes foreign privacy law is someone else's problem. This lesson explains why that assumption is sometimes right and sometimes expensive, and how to tell which.

The aim is short and practical. Lesson 06 covers federal law, and lesson 07 covers the states. For the general-public view of these laws, see Privacy and Data Security Laws. Here we look at what happens when your customers, visitors or staff are in another jurisdiction, and at the one US legal fight over website tracking that hits businesses of every size.

The four regimes on one page

When a US business is in scope of the GDPR

Article 3 of the GDPR sets three doors into the law. Door one is establishment. If you have a branch, office or staff in the EU and the processing is connected to what they do, the GDPR applies to that processing wherever the servers sit. Door two applies when you have no establishment but you process data of people in the Union and the processing relates to offering them goods or services, whether or not they pay. Door three is monitoring their behaviour as far as it takes place in the Union. A fourth paragraph covers places where a member state's law applies by international law, such as an embassy. It rarely matters to a business.

Doors two and three are the ones a US small business trips over. The text of the recitals tells you how regulators read them. Recital 23 says that mere accessibility of the controller's website in the Union is insufficient to show an intention to offer goods or services there. An email address, contact details, or a language common in your home country do not do it either. What can do it is a currency generally used in the member states, especially with the option to order in a language used there, or mentions of customers or users who are in the Union. Recital 24 handles monitoring and asks whether people are tracked on the internet, including later profiling to analyze or predict their preferences and behaviour.

The test has limits. First, I have not seen a court or regulator rule on a bright-line test for pure analytics tools on a US-focused site with some accidental EU traffic. Treat that case as unsettled and decide on risk. Second, an EU-based employee is a hard case. Whether one remote worker creates an "establishment" turns on facts. The safe management move is to treat that person's data under GDPR standards and read the member state's employment rules.

What being in scope costs you

The GDPR is long, so a manager needs the short list of what bites a smaller company that reaches Europe through its website or its sales.

Then there is the money. Article 83(4) allows fines up to EUR 10 million or 2 percent of worldwide annual turnover for certain infringements, such as failures on processor duties or records. Article 83(5) allows up to EUR 20 million or 4 percent for core principle and rights violations and for unlawful transfers. In both cases the greater figure applies. For any company with less than EUR 500 million in turnover, 4 percent comes to less than EUR 20 million, so the flat figure is the ceiling that counts. Article 83(1) tells authorities that fines must be effective, proportionate and dissuasive in each case, which is why the ceiling is rarely the outcome. I did not find a verified dataset of fines against small non-EU companies, so the ceiling is a statement of exposure, not a forecast.

Moving personal data from Europe to the United States

The GDPR does not ban sending personal data to the US. It requires a legal route. Three routes matter for a US business.

On eligibility, a law firm summary of the Department of Commerce program says an organization must be subject to the investigatory and enforcement powers of the Federal Trade Commission or the Department of Transportation to certify. The FTC states that a participant's failure to comply with the Principles may violate Section 5 of the FTC Act, so a false or lapsed claim is a deceptive practice risk. That ties directly back to lesson 01. A company that withdraws but keeps EU data must keep affirming the Principles each year or protect that data some other authorized way, such as SCCs.

Where the legal challenge stands, October 2026

A member of the French parliament challenged the adequacy decision. On 3 September 2025 the EU General Court dismissed the case (T-553/23). The applicant appealed on 31 October 2025, and the Official Journal notice lists the appeal as case C-703/25 P, asking the Court of Justice to set aside the judgment and annul Decision 2023/1795, with the Commission, Ireland and the United States as the other parties. As of this check I found no Court of Justice ruling. A secondary tracker listed the case as unscheduled as of August 2026 and guessed at a decision no earlier than late 2026 or early 2027, which the tracker itself said was not official. Check the Court's own case register before you rely on that guess.

For management the lesson is simple. The framework works today and the decision stays in force while the appeal runs. An earlier version of this arrangement, Privacy Shield, fell in the Court of Justice's Schrems II ruling of 16 July 2020 (case C-311/18). A business that hung all its EU transfers on that single hook had to scramble. A business that already carried SCCs did not.

The Commission's SCC page also says it is developing a further set of clauses for importers whose processing is already directly subject to the GDPR. That would matter to a US firm in scope through Article 3(2). I found no adopted text, so do not assume one exists.

The United Kingdom and Switzerland

The UK has its own version of the GDPR with the same door structure: offering goods or services to people in the UK, or monitoring them. The ICO's UK GDPR page says so. The UK GDPR has a representative duty that parallels the EU one (UK GDPR Article 27), but the ICO page checked for this lesson does not describe it, so confirm on the ICO's site before you appoint or skip one.

Four dated facts shape the UK picture as of October 2026:

• The UK-US data bridge took effect on 12 October 2023. Personal data can go to US recipients that participate in the UK Extension to the DPF without further authorization.
• The International Data Transfer Agreement (IDTA) and the UK Addendum to the EU SCCs took effect on 21 March 2022 as the UK's own contract tools.
• The European Commission renewed its two UK adequacy decisions on 19 December 2025, so data keeps flowing from the EU to the UK.
• The Data (Use and Access) Act 2025 amended UK law. Section 115 and most of the remaining provisions came into force on 5 February 2026 under S.I. 2026/82. A Mishcon de Reya note reports that the maximum fine for breaking the UK cookie rules in PECR (the Privacy and Electronic Communications Regulations) rises from GBP 500,000 to GBP 17.5 million or 4 percent of global turnover, the same level as the UK GDPR. A February 2026 law firm summary also listed a new right to complain to controllers starting 19 June 2026. Confirm that date has passed in practice before you design around it.

Switzerland is its own jurisdiction. Its data protection commissioner confirmed that the Swiss-US Data Privacy Framework took effect on 15 September 2024, covering transfers from Switzerland to US companies that certify under it. Companies certifying to the EU framework can add the UK Extension and the Swiss framework.

Canada: PIPEDA and Quebec's Law 25

PIPEDA, the Personal Information Protection and Electronic Documents Act, is Canada's federal private sector law. According to the Privacy Commissioner's office, it covers private sector organizations that collect, use or disclose personal information in commercial activity, and it always covers federally regulated businesses. Alberta, British Columbia and Quebec have their own private sector laws that are considered substantially similar, and organizations under those laws are generally exempt from PIPEDA for activity inside the province. PIPEDA still applies to personal information crossing provincial or national borders in commercial activity. It rests on ten fair information principles, from accountability to challenging compliance.

Does PIPEDA reach a US company? The Commissioner's office found jurisdiction over a Romanian website in a 2015 finding on the basis of a real and substantial connection to Canada: the site targeted Canadian court decisions, drew exclusively on Canadian sources and took payments from Canadians. The office also said the foreign regulator's interest did not stop it from acting. That is one finding about one website, so treat it as a sign of how the office reasons, not as a rule for every seller. A US company that markets in Canada, takes Canadian orders and holds Canadian customer lists has the connection.

Breach rules

PIPEDA requires you to report to the Privacy Commissioner any breach of security safeguards that it is reasonable to believe creates a real risk of significant harm (RROSH). You weigh the sensitivity of the information against the probability of misuse. You notify affected people as soon as feasible once you determine the risk exists, and you notify other organizations that can reduce harm, such as a payment processor. You must also keep a record of every breach, whether or not it met the threshold, for two years. The organization in control of the data carries the duties even when a processor holds it. Knowingly breaking certain of these requirements is an offence under section 28 punishable by a fine up to C$10,000 on summary conviction or C$100,000 on indictment.

Cross-border processing

The Commissioner's guidance on cross-border processing says an organization stays accountable for personal information it sends to a processor, including one abroad. The processor must give a comparable level of protection, mainly through the contract and checks such as audit rights. The guidance also says no contract overrides a foreign country's laws on access by courts, police or national security agencies, and that you should tell people their information may be processed abroad and be reachable by authorities there. That last point belongs in your notices if your cloud provider's data centres are in the US and the customers are in Canada.

Quebec's Law 25

Quebec amended its private sector privacy act with Law 25 and phased the changes in. Per the Commission d'acces a l'information (CAI), September 2022 brought rules for disclosure without consent in business transactions and research. Most changes came in September 2023, including consent, transparency, anonymization and the requirement to carry out a privacy impact assessment before disclosing personal information outside Quebec. Data portability became mandatory on 22 September 2024. Beyond those dates, the CAI describes these business duties:

• The head of the business is the person responsible for protecting personal information by default, can delegate in writing, and must publish the person's title and contact details on the website.
• Businesses must adopt and publish governance policies on retention, roles and complaints.
• Confidentiality incidents that present a risk of serious injury must be reported to the Commission and to the people affected, and every incident goes in a register that the Commission can ask to see.
• Biometric databases must be disclosed to the Commission at least 60 days before they go into service.

The penalties are the largest in this lesson relative to company size. The CAI says administrative monetary penalties can reach C$10 million or 2 percent of worldwide turnover, and penal fines for enterprises run from a C$15,000 minimum to a maximum of the higher of C$25 million or 4 percent of worldwide turnover, doubled for repeat offences. Whether the statute reaches an out-of-province seller with no presence in Quebec is a jurisdiction question I could not settle from the sources I could open. The practical stance is to treat Quebec customers you actively market to as in scope and ask for the official text of the act (section P-39.1 on LegisQuebec) if you want to test the edge.

The federal bill

Canada's previous attempt at reform, Bill C-27, did not become law. A third attempt, Bill C-36, the Protecting Privacy and Consumer Data Act, had first reading in the House of Commons on 15 June 2026. Parliament's page gives its long title as an Act to enact the Protecting Privacy and Consumer Data Act, amending PIPEDA and other acts. A law-firm summary reported that it would replace Part 1 of PIPEDA and create a new regulator, with administrative penalties up to the greater of C$10 million and 3 percent of global revenue, but that summary was not rechecked against the bill text. Parliament's page lists the bill at second reading in its summary yet shows no activity beyond first reading in its progress table. It is not law. Plan on PIPEDA today and watch the bill.

Cookies, pixels and the tracking fight

Almost every business website runs tags from other companies: analytics, ad pixels, session replay, chat widgets. Each can read from or write to a visitor's browser. That is where law on two continents has focused its attention on ordinary companies.

Europe and the UK

The EU ePrivacy Directive's Article 5(3) is the rule behind the consent banner. In plain terms it requires consent before a site stores or reads information on a person's device, with narrow exceptions for what is strictly needed. On 3 September 2025 the French regulator CNIL announced fines of EUR 325 million on Google and EUR 150 million on Shein for failing to comply with cookie rules. Shein's case was cookies placed without user consent. Google's also covered advertising emails shown in Gmail without prior consent. These were large platforms, but the legal rule applies to a ten-person web shop in the same way.

The rules may change. The Commission proposed a Digital Omnibus on 19 November 2025 that would move some cookie rules into the GDPR. A trade press report from 9 October 2026 says the Council's draft negotiating mandate would keep cookie rules in Article 5(3) of the ePrivacy Directive, drop the browser-level consent signal, and add listed exceptions for narrow purposes such as first-party audience measurement. It also says Parliament has not adopted a position. This is a trade press account of a draft and it is not law. For compliance planning, the current rule is the one that counts.

California

In the United States the fight has been about two old California wiretap statutes applied to new technology. The California Invasion of Privacy Act (CIPA) has a wiretapping provision (Penal Code 631) and a pen register provision (Penal Code 638.51). Plaintiffs' firms sent demand letters and filed suits saying that analytics tags, ad pixels and chat tools on commercial websites either intercept communications or act as pen registers. A law firm summary reports statutory damages of $5,000 per violation, which is why the headline numbers get large fast. A claimed class of 600 visitors at that rate reads as a $3.0 million demand ($5,000 times 600). I do not have a verified dataset of what such cases actually settle for, so treat the arithmetic as the plaintiff's opening position.

The legislature responded with SB 690. As reported by the law firms Pillsbury and Mayer Brown, Governor Newsom signed it in September 2026 and it takes effect on January 1, 2027. It removes the private right of action for website, online application and mobile application claims under section 638.51, leaving enforcement of those claims to the Attorney General. It applies to pending claims in actions commenced within two years before the effective date, which the firms read as actions filed on or after January 1, 2025. Some plaintiffs may challenge that retroactivity, according to one summary. What it does not do: private plaintiffs can still sue under sections 631 and 632 and the related eavesdropping provisions, which carry the same $5,000 per violation exposure reported by Pillsbury. Pillsbury and Mayer Brown both give September 30, 2026 as the signing date. Use the chapter number on California's legislative site when you cite it.

The practical meaning: SB 690 reduces one theory and leaves the other. Keep the discipline either way. Know every third-party tag on your site. Load analytics and advertising tags only after consent where consent is the right basis. Keep a dated tag inventory so you can answer a demand letter in a day.

Data going the other way

One US rule runs the opposite direction. The Department of Justice's Data Security Program, 28 CFR Part 202, took effect on April 8, 2025, with the due diligence and audit requirements delayed to October 6, 2025. It targets access by countries of concern, naming China, to bulk US sensitive personal data and government-related data. The Federal Register text treats vendor agreements as restricted transactions, allowed only if security and other requirements are met, and data brokerage as prohibited. The bulk thresholds in 28 CFR 202.205, measured over the preceding 12 months, are more than 100 U.S. persons for human genomic data, more than 1,000 U.S. persons for other human 'omic data or biometric identifiers, more than 1,000 U.S. devices for precise geolocation, more than 10,000 U.S. persons for personal health or personal financial data, and more than 100,000 U.S. persons for covered personal identifiers. The countries of concern defined in the rule are China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia and Venezuela. The management point is that if a vendor's support staff or sub-vendors abroad can reach your customers' sensitive data, you need to know who and where. Lesson 09 supplies the questions.

Do I need to act? A decision table

Questions to ask your IT provider, web agency and vendors

• Which countries are our website visitors, customers and employees in, by count, from the last 12 months?
• Which third-party scripts load on each page, and which fire before a visitor makes a consent choice?
• Where are our customer databases and backups stored, and which vendors and sub-vendors can reach them from outside the US?
• Do your contracts with us carry Standard Contractual Clauses or Data Privacy Framework certification, and which version?
• Can you give us a breach notice within 24 hours of discovery so that our 72 hour clock is workable?
• Can you produce, on one day's notice, the list of people in the EU, UK and Canada whose data we hold?
• If a European regulator or a Canadian commissioner wrote to us tomorrow, who owns the answer and where is the evidence?

Questions and answers

We only sell in the United States. Do we need to think about any of this?

Mostly not for the EU, UK and Canadian laws, provided you do not target people there and do not employ anyone there. You should still keep a tag inventory and a consent layer, because California's wiretap suits do not depend on where your company sits. Revisit the question each time the sales team opens a new country.

Does a cookie banner fix the GDPR for us?

It fixes part of one rule, the consent rule for non-essential tags under the ePrivacy Directive. The GDPR also asks for a lawful basis, a clear notice, rights handling, security, processor contracts and a breach clock. A banner that lets tags fire before the choice is made does not do even its own job.

What is the difference between a controller and a processor?

A controller decides why and how personal data is processed. A processor handles it for the controller on documented instructions. A US firm taking a European customer's staff data to run a service is usually a processor. The same firm collecting its own web shop customers' data is a controller. Article 28 spells out what the contract between them must say.

Do we have to appoint an EU representative?

If Article 3(2) applies to you, Article 27 requires one in writing unless processing is occasional, unlikely to risk individuals and not large-scale on sensitive or criminal-offence data. A business shipping weekly to the EU does not fit the occasional exception. The representative must sit in a member state where the affected individuals are. Appointing one does not stop regulators or individuals from acting against you directly.

How is the UK different from the EU for us?

It has its own regulator (the ICO), its own transfer tools (the IDTA and the UK Addendum, in force since 21 March 2022) and its own bridge to the US (the UK Extension, since 12 October 2023). The Data (Use and Access) Act 2025 changed parts of UK law with most provisions in force from 5 February 2026. Treat the UK as a separate compliance track that uses the same data map.

What counts as a breach we must report in Canada?

One that creates a real risk of significant harm. You weigh the sensitivity of the information and the probability it will be misused. Record every breach for two years, including ones you decide do not meet the test, since the Commissioner can ask to see your reasoning.

Can we just block European visitors?

Many small companies do. Geoblocking and a checkout that refuses EU addresses are consistent with Recital 23's idea of intent, though no technique is perfect and a few EU orders by VPN or forwarding address do not by themselves show targeting. Weigh the revenue you give up against the cost of compliance, and write the decision down.

Is Standard Contractual Clause paperwork a one-time job?

No. The clauses are signed once per relationship, but you need to keep a current vendor and sub-vendor list, update it when providers change and be able to describe your security measures on request. The Commission's page says it may still add a further set for importers already subject to the GDPR.

Hard questions

"Why would an EU regulator ever bother with a company our size?"

Mostly they do not start with you. Complaints from individuals, a lead from a larger investigation, a customer's audit or a breach report can start a file. The GDPR has no size floor for Article 3. The cost of a small company's first contact is mainly the time spent answering. A tidy record of processing, a notice that matches practice and a signed representative appointment make that answer short.

"The Data Privacy Framework could be struck down. Why pay to certify?"

Because it works today, many EU customers prefer it, and it carries over to the UK and Swiss versions. Certification is not a bet that the Court of Justice will rule your way. Keep SCCs in your contract templates and the ruling becomes a paperwork event instead of a revenue event.

"If SB 690 passed, why keep spending on tag controls?"

Because SB 690 covers one section and starts on January 1, 2027. Section 631 and section 632 claims continue. The same tag inventory serves GDPR consent, California privacy opt-outs and your own security review. Trimming scripts also speeds up the site.

"Our web agency says the banner is optional in the US."

In most US states there is no general banner rule, and that is a fair statement for visitors who are only in those states. It leaves out visitors from the EU and UK, where consent comes first for non-essential tags, and California, where wiretap suits have not depended on whether you had a banner. Check who your visitors actually are, by country, before accepting a blanket answer.

"What if we do nothing and nothing happens?"

That is the most common outcome for a small company, and it is how most boards decide. The risk is asymmetric. A single incident, a complaint or a demand letter converts a quiet exposure into a deadline. The 72 hour clock and the 30 day to 60 day clocks in lesson 11 do not wait while you read the law for the first time.