The First Warning Came Long Ago. Non-EU Companies Still Didn’t Listen

Gianni Dell'Aiuto | WBN News USA | March 4, 2026

GDPR Enforcement Is Global: The Locatefamily.com Warning

The first warning about the reach of Europe’s privacy law did not come yesterday. It arrived years ago, yet many companies outside the European Union still treat the General Data Protection Regulation (GDPR) as if it were a regional rule affecting only large technology firms based in Europe. The case against Locatefamily.com demonstrates why that assumption is dangerously wrong.

In 2021, the Dutch Data Protection Authority fined Locatefamily.com €525,000 for a simple but critical violation. The company processed personal data belonging to EU residents while operating outside the European Union and failed to appoint an EU legal representative, a requirement under Article 27 of the GDPR.

There was no massive cyberattack, no sophisticated data breach, and no controversial algorithm. The violation was structural: the company had no legally designated representative within the EU to act as a point of contact for regulators and data subjects. That absence alone triggered the penalty, along with additional periodic fines.

The case matters because it dismantles a widespread misconception.

Businesses do not need to be global tech giants like Google, Meta, or Amazon to fall under GDPR enforcement. Any organization that processes personal data belonging to EU residents can be subject to the regulation, regardless of where the company is physically located.

Other cases reinforce this principle. Clearview AI faced multiple sanctions in Europe after scraping billions of images from the web to power its facial recognition service. Regulators determined the practice violated core European privacy protections.

Similarly, Luka Inc., the developer of the Replika chatbot, faced enforcement actions due to insufficient safeguards for minors and transparency failures in its data practices.

Even major global platforms have not been immune. Uber has repeatedly faced European penalties tied to unlawful data transfers, transparency shortcomings, and failures to adequately protect user rights.

These cases highlight a crucial reality: GDPR is not simply a privacy guideline. It is a jurisdictional framework governing how companies interact with European personal data.

For organizations outside the EU, compliance begins with a fundamental step—appointing a legitimate EU representative capable of communicating with regulators, managing data subject requests, and ensuring that the company understands its obligations under European law.

Without that bridge into the EU legal system, companies operate blindly. And in Europe’s regulatory landscape, blindness often leads directly to enforcement.

Waiting for a fine is not compliance. It is a costly lesson in governance.

Tags
#GDPR Compliance, #Data Privacy Law, #European Union Regulation, #Global Data Protection, #Digital Governance, #Privacy Enforcement, #Technology Regulation

Gianni Dell’Aiuto is an Italian attorney with over 35 years of experience in legal risk management, data protection, and digital ethics. Based in Rome and proudly Tuscan, he advises businesses globally on regulations like the GDPR, AI Act, and NIS2. An author and frequent commentator on legal innovation, he helps companies turn compliance into a competitive edge while promoting digital responsibility. Click here to connect with him.

Editor: Wendy S. Huffman

Sources:
Dutch Data Protection Authority (Autoriteit Persoonsgegevens) enforcement decision on Locatefamily.com; GDPR Article 27 regulatory guidance; European data protection authority rulings involving Clearview AI, Luka Inc. (Replika), and Uber.