EU Hosting vs US Cloud: Schrems II & the CLOUD Act Explained for Business Owners
What Schrems II, the CLOUD Act, and the Data Privacy Framework mean for where your website's data lives — explained for business owners, not lawyers.
If your website, webshop, or app stores customer data on US-controlled cloud infrastructure, you are relying on a legal arrangement that has been struck down twice and is being challenged a third time. EU hosting under EU jurisdiction sidesteps that entire problem: no transfer mechanism to defend, no adequacy decision to watch, no CLOUD Act exposure through a US parent company.
That is the short version. The longer version involves two court rulings, one US law, and one fragile political agreement — and it is worth understanding, because “where is our data hosted?” is a question your customers, your enterprise clients’ procurement teams, and potentially your data protection authority will ask. This article explains the legal landscape in plain language. We are engineers, not lawyers; this is background for business decisions, and for anything binding you should consult a data protection lawyer.
EU Hosting vs US Cloud: What the Law Actually Says
GDPR does not require your data to stay in the EU. It requires that personal data transferred outside the EU/EEA keeps an “essentially equivalent” level of protection. Transfers to the US are lawful only through an approved mechanism. The history of those mechanisms is the whole story:
Safe Harbor (2000–2015). The first EU–US transfer framework. The Court of Justice of the EU (CJEU) invalidated it in 2015 in Schrems I, after Max Schrems challenged Facebook’s transfers in light of the Snowden disclosures about US surveillance.
Privacy Shield (2016–2020). The replacement. In July 2020, the CJEU invalidated it too, in the ruling known as Schrems II. The court’s reasoning: US surveillance law (notably FISA Section 702 and Executive Order 12333) allows intelligence access to data held by US providers in ways that are not limited to what is strictly necessary, and EU residents have no effective legal remedy against it. Data in US hands therefore did not enjoy essentially equivalent protection.
Standard Contractual Clauses (SCCs), post-2020. Schrems II left SCCs — contract templates between you and the provider — technically valid, but with a catch: you must assess, case by case, whether the destination country’s laws undermine them, and add supplementary measures if so. For US providers subject to surveillance law, that assessment is genuinely hard, because no contract clause binds the NSA.
EU-US Data Privacy Framework (2023–present). In July 2023, the European Commission adopted an adequacy decision for the DPF, restoring a general legal basis for transfers to certified US companies, after the US introduced new safeguards (Executive Order 14086, a redress mechanism). This is the current legal status: transfers to DPF-certified US providers are lawful today. But the DPF is contested. Legal challenges are underway, privacy advocates — including Schrems’ organization noyb — argue it does not fix the problems the CJEU identified, and the underlying US safeguards rest on an executive order that a US administration can weaken or revoke. Many European privacy professionals treat a third CJEU strike-down as a realistic scenario, not a hypothetical.
The pattern matters more than any single ruling: every framework so far has been an attempt to paper over a genuine conflict between EU fundamental-rights law and US surveillance law, and the underlying conflict has not gone away.
The CLOUD Act: Why Server Location Alone Doesn’t Save You
Here is the part that surprises most business owners. The US CLOUD Act (2018) allows US law enforcement, with appropriate legal process, to compel US-based providers to hand over data in their possession, custody, or control — regardless of where the data is physically stored. A US hyperscaler’s data center in Frankfurt is still within reach of a US warrant served on the parent company.
So “we chose the EU region” on a US cloud platform addresses latency and, partially, GDPR data-residency optics — but it does not remove US jurisdiction. The provider is still a US company; the CLOUD Act follows the company, not the server. The major US clouds have introduced “sovereign cloud” offerings and EU-entity structures to mitigate this, and how well those constructions hold up is precisely the kind of question that is legally unsettled and worth a lawyer’s opinion if it is load-bearing for your business.
To be fair about scope: CLOUD Act requests target criminal investigations and are not mass surveillance; the average small business’s shop data is unlikely to interest US authorities. The problem is legal and commercial rather than practical: it complicates your GDPR transfer assessment, it is a hard question in enterprise procurement questionnaires, and it puts your compliance posture at the mercy of litigation you do not control.
EU Hosting vs US Cloud: A Practical Comparison
| Question | EU provider, EU jurisdiction | US provider, EU region | US provider, US region |
|---|---|---|---|
| GDPR transfer mechanism needed | No | Contested — CLOUD Act reach makes this debated | Yes (DPF or SCCs + assessment) |
| Survives a DPF invalidation | Unaffected | Partially exposed | Directly exposed |
| CLOUD Act exposure | No (no US parent) | Yes, via parent company | Yes |
| Enterprise/procurement friction | Low | Medium | High |
| Latency for EU visitors | Good | Good | Worse |
| Typical cost for SMB workloads | Comparable | Comparable | Comparable, plus transfer risk |
The last row deserves emphasis: for websites, webshops, and typical SaaS workloads, European hosting (Hetzner, OVHcloud, Scaleway, and many national providers) is price-competitive with, and often cheaper than, US hyperscalers. The trade-off used to be a thinner managed-services catalogue on EU platforms — real if you need exotic managed databases, irrelevant for the workloads most businesses actually run.
What this means for different businesses
A local business website collects modest personal data (contact forms, maybe analytics). Your legal risk is low either way, but EU hosting means your privacy policy gets one paragraph shorter and one hedge weaker — and self-hosting fonts and using EU analytics removes the most commonly-fined issues entirely.
A webshop processes customer identities, addresses, and order histories at scale. Transfer questions apply to every processor in your stack, not just hosting. We cover the full stack view in GDPR-compliant webshop development.
A SaaS company faces this hardest: your customers’ DPAs pass their compliance obligations through to you, and “where do you host?” appears in every serious procurement process. EU hosting turns a recurring negotiation into a checkbox. This is also where data residency clauses in customer contracts increasingly demand EU processing outright.
The Honest Argument for Just Using EU Infrastructure
You can build a defensible legal position on US cloud today: rely on the DPF, sign SCCs as a fallback, document a transfer impact assessment, monitor the litigation. Plenty of competent companies do exactly this.
Our view, as a studio that has to stand behind what we ship: that is a lot of ongoing legal machinery to defend a choice that, for most European businesses, buys nothing. EU providers deliver equivalent performance and price for standard workloads. Choosing them collapses the entire question — no adequacy decision to monitor, no supplementary measures to document, no exposure if a Schrems III lands. Compliance by architecture is cheaper than compliance by paperwork, and it does not expire when a court rules.
That is why everything we build runs on EU-hosted infrastructure under EU jurisdiction by default, at our published fixed prices (from €50/month or €500 one-time — see pricing):
- GDPR-compliant website development — marketing sites with EU hosting, self-hosted assets, and working consent
- GDPR-compliant webshop development — e-commerce built with EU processors and clean data flows
- EU-hosted web app development — SaaS and web applications with data residency answered at the architecture level
- Privacy-first SEO & analytics — growth without shipping your visitors’ data across the Atlantic
Frequently Asked Questions
Is it illegal to use AWS, Google Cloud, or Azure in the EU? No. Under the current Data Privacy Framework and with proper contracts, it is lawful. The concerns are about robustness — ongoing challenges to the DPF and CLOUD Act jurisdiction — not present-day illegality.
Does an EU region on a US cloud make me GDPR-compliant? It helps (data residency, latency) but does not remove US jurisdiction over the provider. Whether that constitutes a “transfer” requiring safeguards is one of the actively debated questions; regulators have leaned toward caution.
What happened in Schrems II, in one sentence? In July 2020, the CJEU invalidated the EU-US Privacy Shield because US surveillance law prevented US providers from guaranteeing EU-equivalent data protection, while leaving SCCs valid only with case-by-case assessments.
Could the Data Privacy Framework be struck down? It is being legally contested, and its predecessors were both invalidated. Nobody can promise an outcome; prudent architecture does not depend on one.
Do I need a lawyer? For running a small site on EU infrastructure, generally the standard compliance basics suffice. If you transfer personal data to US providers at scale, sign enterprise DPAs, or process sensitive data, yes — get a data protection lawyer’s assessment. This article is engineering background, not legal advice.