Email Marketing List
Email addresses are also considered personal data under the GDPR (Article 4). If you have kept email records or email information through your email marketing campaign (for example, without permission), you should go back and review these lists. Remove all EU-based users from this list or seek permission from them.
Block IP address
One of the solutions to avoid GDPR is to block EU users from accessing your website.
However, if you decide to go this route, you may still want to be careful when implementing your solution. In order to prevent users from entering the EU, your website still has to deal with their IP addresses. IP addresses are considered personal data under the Latest Mailing Database GDPR's definition of personal data, and you may be fined for their processing and collection without the user's explicit consent. However, there is a way to collect IP addresses to block users while still being GDPR compliant.
Part of the GDPR grants users the right not to accept decisions based solely on automated data processing. However, another paragraph (Article 1b(6)) states that this provision does not apply if the decision "is necessary for the conclusion or performance of a contract between the data subject and the data controller."
Therefore, you can state in your terms and conditions that your website is not intended for use by visitors from the European Union. Your terms and conditions are a contract between you and your website visitors; this means that blocking access to EU visitors is just the execution of that contract.
GDPR also protects European Economic Area countries under the “third country” issue. Some of these regions are not in Europe, so you must block those countries as well. These are the Azores, Canary Islands, Guadeloupe, French Guiana, Madeira, Martinique, Mayotte, Reunion and Saint Martin.
Another important thing when blocking IPs from the EU is that no data is collected other than the IP of the country where the user is trying to access your website. Even if you only know the country the user is in, they still won't be able to identify it. To do this, you should set your website to block users before you start collecting data using Google Analytics and any other data processing tools you may use.
Privacy Shield
The EU-US Privacy Shield (Issue: Third Countries) is a framework that allows the transfer of personal data from the EU to the US. The EU does not allow data transfers to other countries unless there are adequate data protection laws. The US does not meet this requirement, so the Privacy Shield was created to correct this problem. The framework proves that U.S. companies are secure enough to transfer data outside the European Union.
Enrolling in the Privacy Shield program is a great way to help your company start working toward GDPR compliance. However, joining does not make your GDPR bulletproof. Even if it is part of the scheme, you should still double check that your business is fully GDPR compliant or you could pay a hefty fine as mentioned above.