# US to EU Expansion: Website GDPR Compliance Checklist

> Selling into the EU from the US? Use this website GDPR checklist to set up cookie consent, a privacy policy, DSARs and EU data transfers with Secure Privacy.

- Canonical: https://support.secureprivacy.ai/article/us-company-expanding-to-eu-website-gdpr-compliance-checklist
- Product: Consent Management
- Category: Compliance & Regulations
- Published: 2026-10-20T20:50:00+00:00
- Updated: 2026-10-20T20:51:37.645+00:00
- Reading time: 16 minutes

---

Your company is based in the US and you are about to start selling to European customers. The question usually lands on the website team first: **what does our website need before EU visitors start arriving?** The short answer is that the **GDPR applies to US companies** that offer goods or services to people in the EU, even if you have no office, staff or servers there. In practice, that means EU visitors must see a cookie banner that actually blocks tracking until they agree, your privacy policy must meet GDPR transparency rules, and you need a working channel for privacy rights requests.

Most teams try one of three shortcuts first. Some copy their existing CCPA "Do Not Sell" setup, which uses an opt-out model that does not meet EU opt-in rules. Some install a free cookie plugin that shows a banner but lets Google Analytics and ad pixels load anyway. Others paste a generic privacy policy template that never mentions an EU representative, international data transfers or the rights EU users actually have. Each of these looks compliant on the surface and fails the first time a regulator, customer or partner looks closely.

**Secure Privacy** handles both sides from one account. You keep your US opt-out experience for US visitors and add a geo-targeted **GDPR cookie consent banner** for the EU, backed by automatic cookie blocking, a GDPR privacy policy generator, a data subject request form and consent records stored in the EU. As a Google Gold CMP Partner covering 65+ privacy laws, it also passes Google Consent Mode v2 signals so your Google Ads and GA4 measurement keeps working in Europe.

By the end of this article you will have a complete **EU website compliance checklist**, a step-by-step setup in Secure Privacy, and a clear list of the GDPR obligations a US company must handle outside the website itself.

**Important:** This guide explains common EU website privacy requirements and how to configure them in Secure Privacy. It is not legal advice. Which obligations apply to you depends on what data you collect, who your customers are and which countries you sell into, so review your setup with your legal counsel or Data Protection Officer before launch.

## In This Article

-   [Who is this for](#who-is-this-for)
-   [Does GDPR apply to a US company selling into the EU?](#does-gdpr-apply)
-   [EU website compliance checklist at a glance](#checklist)
-   [Prerequisites](#prerequisites)
-   [How to set up an EU-ready website with Secure Privacy](#setup)
-   [GDPR obligations beyond the website](#beyond-the-banner)
-   [What happens after launch](#what-happens-after)
-   [Troubleshooting common EU rollout problems](#troubleshooting)
-   [Frequently asked questions](#faq)
-   [Related articles](#related-articles)

## Who Is This For?

-   US and other non-EU businesses launching sales, shipping or marketing to customers in the EU or EEA
-   E-commerce and B2B teams adding EU markets to a website that was built for US privacy laws such as the CCPA
-   Marketing teams running Google Ads, GA4, Meta or LinkedIn campaigns aimed at European audiences
-   Website owners, developers and compliance leads who need a practical GDPR checklist to work through with their legal team

## Does GDPR Apply to a US Company Selling Into the EU?

Yes, in most cases. Under [Article 3(2) of the GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/oj), the regulation applies to organizations outside the EU when they either **offer goods or services to people in the EU** (paid or free) or **monitor their behavior**, for example with analytics, advertising pixels or profiling. Shipping to EU addresses, pricing in euros, offering EU languages or running ads aimed at EU countries are typical signs that you are targeting the EU market.

Two rule sets meet on your website. The **ePrivacy Directive** decides _when_ you need consent to place cookies or similar trackers, and the **GDPR** decides _what_ valid consent looks like and governs everything else you do with personal data. For a primer on the regulation itself, see [What Is GDPR? A Simple Guide to GDPR Compliance](https://support.secureprivacy.ai/article/what-is-gdpr).

## EU Website Compliance Checklist at a Glance

Use this table as your working list. The first seven items live on your website; the last four are organizational obligations that your website content must reflect.

| Requirement | Legal basis | What it means for your website | Where Secure Privacy helps |
| --- | --- | --- | --- |
| Prior consent for non-essential cookies | ePrivacy Directive Art. 5(3), GDPR Art. 7 | Analytics, advertising and social cookies stay blocked until the visitor opts in. Rejecting must be as easy as accepting. | Automatic Blocking, opt-in GDPR template |
| Cookie declaration | GDPR Art. 13, ePrivacy transparency | A list of every cookie and tracker with its provider, purpose and duration. | Website scanner and auto-generated cookie declaration |
| Consent withdrawal | GDPR Art. 7(3) | Visitors can change or withdraw consent at any time, as easily as they gave it. | Privacy widget and Preference Center |
| Proof of consent | GDPR Art. 7(1) | You can show who consented, to what, and when. | Consent Dashboard with CSV export |
| GDPR privacy policy | GDPR Art. 13 and 14 | Explains what you collect, why, your lawful basis, retention, recipients, international transfers, user rights and your EU representative. | Privacy policy generator and multilingual policies |
| Data subject rights requests | GDPR Art. 12 to 22 | A clear way to request access, correction, deletion or portability, answered within one month. | DSAR form builder and Self-Service Privacy Rights Portal |
| Google consent signals | Google EU User Consent Policy | If you use Google Ads or GA4, consent choices must be passed to Google through Consent Mode v2. | Built-in Google Consent Mode (Basic or Advanced) |
| EU representative | GDPR Art. 27 | Most non-EU companies must appoint a representative in the EU and name them in the privacy policy. | GDPR representative services (outside the CMP) |
| Lawful EU-to-US data transfers | GDPR Chapter V | Data sent to your US systems and vendors needs a transfer mechanism, such as the Data Privacy Framework or Standard Contractual Clauses. | Consent records stored in the EU; DPO guidance |
| Records of processing | GDPR Art. 30 | An internal register of what personal data you process and why. | Governance Solution Process Register |
| Data Protection Officer check | GDPR Art. 37 | Decide and document whether you need a DPO. | DPO as a Service |

## Prerequisites

-   A Secure Privacy account with your website domain added ([see the account setup and onboarding guide](https://support.secureprivacy.ai/article/secure-privacy-onboarding-guide--quick-setup-steps))
-   Access to your website's code, CMS or Google Tag Manager to install or verify the Secure Privacy script
-   A list of the third-party tools on your site: analytics, ad pixels, chat widgets, video embeds, payment and shipping integrations
-   Your company details for the privacy policy, including your EU representative's contact details if you have appointed one
-   The list of EU and EEA countries you plan to sell into, plus the UK and Switzerland if they are in scope

## How to Set Up an EU-Ready Website With Secure Privacy

Follow these steps to add a GDPR-compliant cookie consent setup for EU visitors while keeping your existing US experience in place.

### Step 1 - Scan your website from an EU location

Cookies and scripts can differ by visitor location, so run your first scan as an EU visitor would see your site. In your scan settings, choose an EU scan location and start a scan. Review the results to see every cookie, pixel, iframe and service that loads. See [how to configure scan location and frequency](https://support.secureprivacy.ai/article/scan-report-settings-in-secure-privacy) and [how to read your scan results](https://support.secureprivacy.ai/article/scanning-your-website-for-compliance).

### Step 2 - Classify every cookie and service

Assign each detected item to a category such as Essential, Preferences, Analytics, Advertising or Social Media. Secure Privacy does not auto-block cookies that are still unclassified, so this step decides what your banner actually controls. Only cookies that are strictly necessary for the site to work may stay in the Essential category. Follow [the domain-level cookie classification guide](https://support.secureprivacy.ai/article/how-to-classify-cookies-and-services-for-a-domain) and read [why unclassified cookies are not auto-blocked](https://support.secureprivacy.ai/article/unclassified-cookies-in-secure-privacy-why-they-arent-auto-blocked).

### Step 3 - Create a GDPR template geo-targeted to the EU and EEA

Open the **Templates** tab and create or edit a GDPR template. In the geo-targeting settings, select the EU member states plus Iceland, Liechtenstein and Norway (the EEA). Set the consent type to **Explicit Consent (Opt-In)**. Keep your existing US template for California and other US states, so each audience sees the banner its laws require. The [Templates settings guide](https://support.secureprivacy.ai/article/simplify-privacy-management-with-templates-settings-explained) explains every option.

![Secure Privacy template geo-targeting settings selecting EU countries for a GDPR cookie consent banner](https://pub-7bd19505838640d0a08ef1bd6ec3fb9b.r2.dev/articles/912ca2b242185f8268eb-3677a40ce9b2.webp)

Select the EU and EEA countries your GDPR template should cover.

![Secure Privacy consent type setting with Explicit Consent (Opt-In) selected for GDPR compliance](https://pub-7bd19505838640d0a08ef1bd6ec3fb9b.r2.dev/articles/674053383da7f119975c-ea2f9aab2370.webp)

Use Explicit Consent (Opt-In) for EU visitors.

### Step 4 - Turn on Automatic Blocking for your domain

Go to **Domains**, open your domain and check that the **Blocking** section is set to **Automatic Blocking**. This keeps non-essential cookies and trackers from loading until the visitor consents, which is the core requirement for EU visitors. In the same Domain Settings page, assign your GDPR template. See [Secure Privacy Domain Settings](https://support.secureprivacy.ai/article/managing-domain-settings-in-secure-privacy) and the [complete guide to blocking cookies for GDPR compliance](https://support.secureprivacy.ai/article/complete-guide-to-blocking-cookies-for-gdpr-compliance-prior-consent-script-load).

![Secure Privacy Domain Settings showing Automatic Blocking selected to block cookies before consent for EU visitors](https://pub-7bd19505838640d0a08ef1bd6ec3fb9b.r2.dev/articles/71ac59c01de764c535e5-d48f1e9c67ff.webp)

Automatic Blocking prevents tracking before consent.

### Step 5 - Configure the banner, languages and consent withdrawal

Make sure the first layer of your banner offers Accept and Decline with equal prominence, and that visitors can reach granular category choices in the Preference Center. Add the languages of the countries you sell into; Secure Privacy supports more than 70 languages and shows the right one based on the visitor's browser. Keep a privacy widget, button or footer link on every page so visitors can withdraw consent later. See [how to customize your cookie consent banner](https://support.secureprivacy.ai/article/customize-your-websites-cookie-banner-using-templates), [what each banner button does](https://support.secureprivacy.ai/article/cookie-banner-and-preference-center-buttons-logic-explained-withdraw-consent) and [how to add a Preference Center widget](https://support.secureprivacy.ai/article/how-to-add-a-preference-center-widget-button-or-hyperlink-to-your-website).

### Step 6 - Enable Google Consent Mode v2 if you use Google Ads or GA4

If you advertise with Google or measure EU traffic in Google Analytics 4, enable **Google Consent Mode** in your Domain Settings and choose Basic or Advanced. Without valid consent signals for EEA traffic, Google can restrict conversion tracking and remarketing audiences. Compare the modes in [Google Consent Mode: Basic vs Advanced](https://support.secureprivacy.ai/article/basic-vs-advanced-google-consent-mode-full-comparison-guide) and review [Google's EU User Consent Policy requirements](https://support.secureprivacy.ai/article/google-eu-user-consent-policy-compliance-guide--secure-privacy).

### Step 7 - Publish a GDPR privacy policy and cookie declaration

Use the **Policies** page to generate a privacy policy that covers your lawful bases, retention periods, recipients and processors, international data transfers, user rights, how to complain to a supervisory authority, and your EU representative's contact details. Publish the auto-generated cookie declaration alongside it and link both from your footer and banner. See [how to create a GDPR privacy policy in Secure Privacy](https://support.secureprivacy.ai/article/the-policies-page-a-deep-dive-into-privacy-and-user-data-collection) and [how to manage, translate and publish policies](https://support.secureprivacy.ai/article/mastering-policies-page-for-effective-policy-management).

### Step 8 - Add a data subject request (DSAR) form

EU users have the right to access, correct, delete and port their data, and you generally have one month to respond. Build a DSAR form with identity verification and deadline tracking, then link it from your privacy policy and Preference Center. See [what's new in the DSAR 3.0 form builder](https://support.secureprivacy.ai/article/dsar-3-0-dsar-form-builder-privacy-requests) and the [Self-Service Privacy Rights Portal](https://support.secureprivacy.ai/article/self-service-privacy-rights-portal-submit-gdpr-ccpa-data-requests-and-link-from-).

### Step 9 - Install the script and verify the EU experience

Confirm the Secure Privacy script loads first in your page head, before any analytics or ad tags ([see the script installation guide](https://support.secureprivacy.ai/article/installation-of-secure-privacy-script-on-a-new-domain)). Then test as an EU visitor, for example with a VPN set to Germany or France: the GDPR banner should appear, tracking requests should stay blocked until you accept, and your choice should appear in the [Consent Dashboard](https://support.secureprivacy.ai/article/navigate-and-utilize-your-consent-dashboard-an-indepth-guide). Run a fresh scan to confirm nothing fires before consent.

## GDPR Obligations a US Company Must Handle Beyond the Website

A compliant banner and privacy policy are the visible part of GDPR. These organizational steps sit behind them, and your privacy policy needs to describe them accurately.

### Appoint an EU representative under GDPR Article 27

Most companies with no establishment in the EU must appoint a representative in an EU member state where they have customers. The representative is a point of contact for EU regulators and individuals, and their details belong in your privacy policy. There is a narrow exemption for occasional, low-risk processing that does not involve sensitive data at scale, so confirm with counsel whether it applies to you. Learn more about [GDPR representative services from Secure Privacy](https://secureprivacy.ai/blog/eu-gdpr-representative-services).

### Use a lawful mechanism for EU-to-US data transfers

Personal data that flows from EU visitors to your US CRM, e-commerce platform, help desk or ad tools is an international transfer under Chapter V of the GDPR. The **EU-US Data Privacy Framework** remains in force for transfers to certified US organizations, but an appeal against it is pending at the Court of Justice of the EU, so many teams also keep Standard Contractual Clauses in their vendor contracts as a fallback. Read [whether the EU-US Data Privacy Framework is at risk](https://secureprivacy.ai/blog/is-the-eu-us-data-privacy-framework-at-risk-the-ftc-ruling-explained-2026) and [how a DPO manages GDPR international data transfers](https://support.secureprivacy.ai/article/cross-border-data-transfers-and-your-dpo). Secure Privacy itself [stores your data within the EU](https://support.secureprivacy.ai/article/-where-is-my-data-stored--secureprivacy-data-location).

### Decide whether you need a Data Protection Officer

A DPO is mandatory only in specific cases, such as large-scale monitoring of individuals or large-scale processing of sensitive data, but you should document the decision either way. See [when appointing a DPO is mandatory under GDPR](https://support.secureprivacy.ai/article/when-is-appointing-a-dpo-mandatory).

### Keep records of processing activities

Article 30 requires a register of what personal data you process, why, who receives it and how long you keep it. It also makes your privacy policy much easier to write accurately. See [GDPR Records of Processing Activities (ROPA)](https://support.secureprivacy.ai/article/gdpr-article-30-records-of-processing-activities).

**Selling physical products into the EU?** Product rules can add website content that has nothing to do with privacy. For example, under the EU Battery Regulation (EU) 2023/1542, batteries must carry a QR code from 18 February 2027, and electric vehicle, light means of transport and industrial batteries above 2 kWh need a digital battery passport from the same date. Consumer-facing online shops are also covered by the European Accessibility Act, which has applied since 28 June 2025, and some countries such as Germany and Austria expect a legal notice (imprint) page. Secure Privacy covers privacy and consent; confirm product, accessibility and consumer-law requirements with your compliance or legal team. For your consent banner itself, see [how Secure Privacy keeps cookie banners WCAG-accessible](https://support.secureprivacy.ai/article/accessibility-and-ada-compliance-with-secure-privacy-banners).

## What Happens After Launch

-   **Consent records build up automatically.** Every choice an EU visitor makes is logged, so you can export proof of consent if a regulator or partner asks.
-   **Your site keeps changing, so rescan.** New landing pages, pixels and plugins add cookies. Schedule recurring scans and classify anything new right away.
-   **Review your setup on a schedule.** Use the [cookie compliance review checklist](https://support.secureprivacy.ai/article/ongoing-checkups-best-practices-compliance) each quarter and whenever you add a market or a marketing tool.
-   **Watch for EU rule changes.** The EU's Digital Omnibus proposal could change parts of the cookie consent rules, but it is still being negotiated and today's GDPR and ePrivacy rules apply in full until anything new is adopted. See [what the Digital Omnibus could change for cookie consent](https://secureprivacy.ai/blog/eu-digital-omnibus-what-article-88a-changes-for-cookie-consent-2026).

## Troubleshooting Common EU Rollout Problems

### EU visitors do not see the GDPR cookie banner

Check that the GDPR template is assigned to the domain and that its geo-targeting includes the country you are testing from. When testing with a VPN, clear cookies or use a private window so an earlier consent choice is not reused.

### Cookies still load before consent

The usual causes are unclassified cookies, Manual Blocking mode, or analytics tags that load before the Secure Privacy script. Work through [how to fix cookies loading before consent](https://support.secureprivacy.ai/article/ensuring-prior-consent-for-nonessential-cookies-gdpr-compliance). If cookies from an earlier visit are still visible after declining, that is expected; see [why cookies stay visible after declining consent](https://support.secureprivacy.ai/article/why-cookies-are-still-visible-after-declining-consent-and-why-that-means-trackin).

### Google Ads or GA4 shows consent warnings for EEA traffic

Google Consent Mode is off by default. Enable it in Domain Settings, then confirm the signals with [how to check if Google Consent Mode is working](https://support.secureprivacy.ai/article/checking-the-google-consent-mode-implementation).

### The banner appears in the wrong language

The banner follows the visitor's browser language. Add each language you need to the template; if a language is missing, the banner falls back to the default.

### US visitors now see the opt-in GDPR banner

Your GDPR template's geo-targeting probably includes too broad a region. Limit it to EU and EEA countries (plus any others you deliberately treat the same way) and keep your US template for US states.

## Frequently Asked Questions

### Does GDPR apply to US companies?

Yes, when a US company offers goods or services to people in the EU or monitors their behavior online, for example through analytics or advertising cookies. It applies even if the company has no office, employees or servers in Europe.

### Do I need a cookie banner if my company is in the US but sells to Europe?

Yes, if your website uses non-essential cookies or trackers such as Google Analytics, ad pixels or social media embeds. EU rules require opt-in consent before those load, and the banner must actually block them until the visitor agrees.

### Do US companies need an EU representative under GDPR?

Usually, yes. Article 27 requires most non-EU companies subject to GDPR to appoint a representative in the EU and list their contact details in the privacy policy. A narrow exemption exists for occasional, low-risk processing that does not involve sensitive data at scale.

### Can I use one cookie banner for both CCPA and GDPR?

You can manage both from one Secure Privacy account, but EU and US visitors should see different experiences. Geo-targeted templates show an opt-in GDPR banner to EU visitors and an opt-out experience, such as a "Do Not Sell or Share" link, to visitors from US states.

### Is the EU-US Data Privacy Framework still valid?

Yes. The EU General Court upheld it in September 2025 and it remains in force for transfers to certified US organizations. An appeal is pending at the Court of Justice of the EU, so many companies also keep Standard Contractual Clauses in place as a fallback.

### What are the fines for GDPR non-compliance?

The most serious violations can lead to fines of up to €20 million or 4% of total worldwide annual turnover, whichever is higher. Regulators can also order you to stop processing, and individuals can file complaints or claim compensation.

### Can I use Google Analytics on my website for EU visitors?

Yes, with prior consent. Analytics cookies are not strictly necessary, so Google Analytics must wait for opt-in. With Google Consent Mode v2, GA4 respects each visitor's choice and can use modeling to fill some of the gaps left by visitors who decline.

### Does the UK follow the same rules as the EU?

Not exactly. The UK has its own UK GDPR and cookie rules, which are similar to the EU's but not identical. If you sell to UK customers, add the UK to your geo-targeting deliberately and check whether you also need a UK representative.

### Will the EU Digital Omnibus change cookie banner rules?

It might in the future, but it is still a proposal under negotiation. Until any changes are formally adopted and take effect, the current GDPR and ePrivacy cookie consent rules apply in full, so plan your EU launch against today's rules.

## Related Articles

-   [What Is GDPR? A Simple Guide to GDPR Compliance](https://support.secureprivacy.ai/article/what-is-gdpr)
-   [What Is a Cookie Banner? GDPR Requirements and Consent Management](https://support.secureprivacy.ai/article/why-do-you-need-a-cookie-banner-on-your-website)
-   [GDPR Cookie Categories Explained](https://support.secureprivacy.ai/article/should-you-block-all-cookies-gdpr-cookie-categories-explained)
-   [E-Commerce GDPR Compliance: Data Protection for Online Retail](https://support.secureprivacy.ai/article/industry-specific-dpo-guidance-ecommerce-retail)
-   [How to Configure the "Do Not Sell or Share My Personal Information" CCPA Opt-Out Widget](https://support.secureprivacy.ai/article/ccpa-cpra-do-not-sell-compliance)
-   [How to Implement Google Consent Mode Advanced with Google Tag Manager](https://support.secureprivacy.ai/article/implementing-google-consent-mode-advanced-using-google-tag-manager-community-template)
-   [Secure Privacy: Google-Certified Consent Management Platform](https://support.secureprivacy.ai/article/secure-privacygooglecertified-consent-management-platform)
-   [Global Data Privacy Laws by Country and Region](https://support.secureprivacy.ai/article/global-data-privacy-compliance-solutions--secure-privacy)

## Ready to Launch in the EU?

Set up your geo-targeted GDPR banner, privacy policy and DSAR form in one place and keep your US experience unchanged. [Get started with Secure Privacy for free](https://secureprivacy.ai), or contact [Secure Privacy support](mailto:support@secureprivacy.ai) if you need help with your EU rollout.