A Canadian uploads photos to a social media platform headquartered in California, stored on servers in Ireland, processed by contractors in the Philippines, and backed up in data centers in Singapore. When they request deletion, which country's privacy law applies? A European company transfers employee data to American cloud services, potentially exposing it to US government access that would be illegal under European law. A person's information collected by a domestic retailer is sold to a data broker who resells it to companies across dozens of countries with varying privacy protections.