It's much more complicated than that. The article 3 (https://gdpr-info.eu/art-3-gdpr/) says two possible ways to get into a territorial scope of GDPR:
- the offering of goods or services
- the monitoring of behavior of data subjects
Offering doesn't mean that it's just available and/or sellable in EU. It's more complicated than that. EDPB has a guidance on this topic: https://edpb.europa.eu/our-work-tools/general-guidance/guide... In short, document shows examples where some services are available in EU, and sellable there but personal data isn't covered by GDPR.
On the other hand, my understanding is that monitoring of behavior is always covered by GDPR.
(I am not a lawyer and this is not a legal advice)
- the offering of goods or services
- the monitoring of behavior of data subjects
Offering doesn't mean that it's just available and/or sellable in EU. It's more complicated than that. EDPB has a guidance on this topic: https://edpb.europa.eu/our-work-tools/general-guidance/guide... In short, document shows examples where some services are available in EU, and sellable there but personal data isn't covered by GDPR.
On the other hand, my understanding is that monitoring of behavior is always covered by GDPR.
(I am not a lawyer and this is not a legal advice)