Quick answer: Most US clients don’t ask about GDPR upfront, and many have never heard of it. But do US clients care about GDPR? They should, because it can still bind their website if even one EU visitor’s data gets collected. As an international freelancer, your job is knowing this before your client does, not after a regulator’s letter arrives.
I build sites for American small businesses regularly, and GDPR almost never comes up in the first call. That silence doesn’t mean it’s irrelevant. It usually means nobody on the client’s side has connected their contact form to a European legal framework yet.
Why Don’t US Clients Bring This Up Themselves?
Because GDPR sounds like someone else’s problem. A bakery owner in Ohio isn’t thinking about European data protection law when they ask for a new website. Their business feels local, even if their site technically reaches anyone with an internet connection.
That gap between perception and reality is exactly where freelancers add value. Most American clients genuinely don’t know that GDPR can apply to them regardless of where their company sits. Since 2018, EU regulators have issued $5.65 billion in GDPR fines, and US companies account for 83% of that total, according to a 2026 analysis of enforcement data. That’s not a small technicality.
Does GDPR Actually Apply to a US-Only Business?
Yes, under specific conditions, and this is the part worth explaining clearly to every client. GDPR’s Article 3 triggers extraterritorial application in two situations. First, if the business has any establishment in the EU. Second, and more relevant here, if the business offers goods or services to people in the EU, or monitors their online behavior.
Neither trigger depends on where the company is registered. A US-based ecommerce store shipping to Germany falls under GDPR. A US-based SaaS tool with European sign-ups falls under it too. Legal analysis from JD Supra confirms GDPR reaches many US businesses even without any physical EU presence, purely based on who they serve.
That’s the nuance most clients miss entirely: GDPR follows the data, not the border.
What This Means for You as the Freelancer
Here’s where it gets practical. If you build or maintain a site that processes personal data — contact forms, newsletter sign-ups, ecommerce checkouts, analytics tracking — you’re often acting as a data processor under GDPR, even working for a US client. That role carries real obligations, not just the client’s.
Standard data processing agreements typically require the processor to handle personal data only under the client’s instructions, keep records of processing activity, and notify the client of any data breach quickly. If you skip this conversation, you’re not protected just because your client didn’t ask.
The Question to Ask Every New Client
Before starting any project with EU-facing potential, I ask one simple question: will this site ever have European visitors, customers, or subscribers? Almost every client says yes once they think about it, because most websites are public by default.
That answer changes what the build actually needs. A GDPR-aware cookie consent banner, a clear privacy policy, and a lawful basis for any data collection aren’t extras. They’re baseline requirements the moment European visitors show up in analytics, regardless of what country the client calls home.
A Mistake I See Constantly
Freelancers sometimes assume “my client is American, so American privacy rules apply.” That logic breaks down fast. Privacy law follows the visitor’s location, not the client’s mailing address. A freelancer who never raises GDPR with a US client isn’t protecting anyone — they’re just delaying a harder conversation until after launch, when fixing consent flows costs more time and trust.
This connects directly to something I cover in more depth elsewhere: the actual website requirements that differ across the US, UK, and EU. GDPR is one piece of a bigger compliance picture that changes depending on who visits the site, not just who commissions it.
Should This Change How You Price a Project?
Somewhat, yes. Building proper cookie consent, a compliant privacy policy, and clean data-handling practices from the start takes more time than skipping it. I’ve found clients respond well when this gets framed as risk reduction, not upsell. Nobody wants a $5.65 billion enforcement statistic landing anywhere near their own website.
If you’re newer to freelancing internationally and unsure how to have this conversation with clients, it’s worth reading through how remote developers work with clients across borders more broadly, since data compliance is just one part of that trust-building process.
Frequently Asked Questions
Do US clients usually ask about GDPR before hiring a freelancer? Rarely. Most US business owners haven’t considered whether GDPR applies to them, so the freelancer often needs to raise it first.
Can GDPR apply to a business with no EU offices or employees? Yes. GDPR applies based on whether a business offers goods or services to people in the EU, or monitors their behavior online, regardless of company location.
Am I liable as a freelancer if my client’s site violates GDPR? You can carry processor-level obligations if you handle personal data on the client’s behalf, so a written data processing agreement protects both parties.
What’s the simplest first step for GDPR compliance on a small business site? Add a genuine opt-in cookie consent banner and a clear, accurate privacy policy, then confirm any third-party tools (analytics, forms) handle data lawfully.
How big are the financial risks if a US company ignores GDPR? Significant. US companies account for 83% of the $5.65 billion in GDPR fines issued since 2018, according to recent enforcement tracking.
Should every freelancer discuss GDPR with every client? Only when the client’s site could reasonably reach EU visitors, which covers most public websites. Purely internal tools or geo-restricted sites may not need it.
Getting data compliance right from the start protects your client and your own reputation as a developer. If you want a second opinion on whether your current site setup handles this properly, message me on WhatsApp and I’ll take an honest look.