Many of the major data privacy laws, including GDPR, PIPEDA, and CCPA, have clauses that require organizations both inside and outside of their territories to comply. These laws are meant to protect citizens within their territories, and due to the nature of the internet, it is nearly impossible for companies to restrict access to their websites and services in certain territories. This is especially true because of modern VPNs, which often circumvent regional restrictions.