Earlier quoted context omitted.
They can’t possibly be breaking UK law because the service isn’t even being provided in the UK. UK users are accessing US servers to get service.
> UK users are accessing US servers to get service. That's called offering the service to UK users. I don't host my blog in 165 times in each country in order to let people to access my content/services.
> That's called offering the service to UK users.
It is not – not under US law, not under common law (in the UK/Commonwealth).
Under US law and in common law systems generally, a website being merely accessible from country XYZ does not, by itself, constitute «offering a service» into XYZ. Courts look for purposeful targeting of, or meaningful interaction with, users in that place. Mere accessibility is not enough. See [0] for a precedent.
1. The US approach in a nutshell.
a) Personal-jurisdiction basics: a court needs «minimum contacts» that the website operator created with the forum. The US Supreme Court has previously stressed that the plaintiff’s location or where effects are felt is not enough if the defendant did not create forum contacts.
b) The «Zippo sliding scale» test distinguishes passive sites from interactive, commercial ones. Passive presence online generally does not create jurisdiction. See [1] for a landmark opinion.
c) The Fourth Circuit’s ALS Scan test says a state may exercise jurisdiction when the defendant directs electronic activity into the state, with a manifest intent to do business or interact there, and that activity gives rise to the claim. Simply putting content on the web is not enough. Again, see [0] for an established precedent.
2. The common law/European «targeting» idea
a) UK and EU courts apply a similar targeting notion in various contexts. The CJEU in Pammer/Alpenhof held that a site must be directed to the consumer’s member state; mere accessibility is insufficient. UK cases on online IP use also examine whether activity is targeted at UK users. See [2] for an established precedent on the other side of the pond.
b) Data-protection law is also explicit: the GDPR applies to non-EU operators when they offer goods or services to people in the EU or monitor them. Recital 23 and the EDPB’s guidelines list indicators such as using a local language or currency, shipping to the territory, local contact details, and targeted ads. Accessibility alone does not trigger the rule.
To recap, if a US-hosted site simply serves content that UK users can reach, that alone does not mean the operator is «offering a service» to the UK or its citizens under US law or general common-law principles. Liability or regulatory reach typically turns on targeting and purposeful availment, not mere availability. Circle back to [0] for details again.
[0] https://law.justia.com/cases/federal/appellate-courts/F3/293...
[1] https://en.wikipedia.org/wiki/Zippo_Manufacturing_Co._v._Zip....
[2] https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A...