Extraterritoriality: How nations govern the world

The concept of a nation-state is traditionally defined by its borders. Within those lines, its word is law; outside of them, it is merely a neighbor. Yet the modern reality of global governance has steadily eroded this once-clear distinction through the mechanism of extraterritoriality - the legal principle that allows a state to apply its laws and exercise its authority beyond its own geographical boundaries.

The idea carries deep historical weight. The Westphalian settlement of the 17th century gave birth to a world order premised on sovereign equality: states would not interfere in each other's internal affairs. That order has not collapsed, but it has been substantially renegotiated. The dense interconnectedness of modern finance, digital data, and human rights has made purely territorial law an inadequate instrument. The result is a world in which a judge in New York, a regulator in Brussels, or a prosecutor in Stockholm can issue decisions that reshape the lives of people who have never set foot in those cities and have no vote in those jurisdictions.

This is not a technical adjustment at the margins of legal codes. It is a fundamental reconfiguration of how power is projected on the global stage.

Historical roots and the colonial inheritance

The roots of extraterritoriality lie deep in the colonial era. During the 19th and early 20th centuries, Western powers routinely negotiated treaties with non-Western nations - most notoriously with China and the Ottoman Empire - that exempted their citizens from local laws, subjecting them instead to the jurisdiction of their home country. These so-called unequal treaties served as legal scaffolding for imperial dominance, ensuring that a British merchant in Shanghai or a French diplomat in Constantinople operated under a different, privileged set of rules.

Those treaties are largely relics now. But the underlying impulse - protecting a nation's interests beyond its own frontiers - has not gone away. What has changed is the justification and the scale. Today's extraterritorial reach is not about protecting colonial settlers; it is about regulating systemic flows of capital, data, and corporate conduct across an interconnected global economy.

The fundamental principles of extraterritorial jurisdiction

To understand why a judge in New York or a regulator in Brussels can influence events in Singapore or São Paulo, we must examine the specific legal doctrines that authorize such reach. International law recognizes several distinct bases of jurisdiction that allow a state to look beyond its own borders. These principles provide the scaffolding upon which extraterritorial claims are constructed.

The nationality principle and the protective principle

The nationality principle is the most intuitive starting point. It holds that a state can exercise jurisdiction over its own citizens regardless of where in the world they happen to be located. If a French citizen commits a serious crime in a region where local enforcement is absent or unwilling to act, French courts may still prosecute that individual upon their return. Citizenship, under this principle, functions as a kind of permanent legal tether - one that follows the individual across every border they cross.

Complementing this is the protective principle, which allows a state to apply its laws extraterritorially to safeguard vital national interests. It typically applies to offenses like espionage, the counterfeiting of national currency, or perjury before a diplomatic official. Because such acts strike at the integrity of the state itself, the physical location of the perpetrator becomes secondary to the identity of the victim: the state as an institution.

Universal jurisdiction and the moral imperative

One of the most far-reaching expansions of legal authority is universal jurisdiction - the principle that any state may prosecute certain international crimes regardless of where they occurred or the nationality of those involved. The underlying logic is that some offenses are so categorically heinous that they become, in the classical Latin formulation, hostis humani generis: enemies of all humanity. Any state therefore has not merely the right but the duty to provide a forum for justice.

The numbers tell a story of a doctrine that is quietly gaining momentum. According to the most recent Universal Jurisdiction Annual Review - the most comprehensive audit of its kind, covering developments across 16 countries - 95 active extraterritorial and universal jurisdiction cases were being prosecuted at the time of publication. In a single recent year, 36 new cases were opened and 27 suspects were convicted at first instance or on appeal, nearly double the number recorded the previous year. Germany and Denmark each adopted legal reforms specifically to strengthen their capacity to investigate and prosecute international crimes committed abroad.

One case illustrates the doctrine's reach with particular clarity. In May 2024, a Swiss court convicted Ousman Sonko - the former Interior Minister of The Gambia - of crimes against humanity and sentenced him to 20 years in prison. It was the highest-ranking state official ever convicted in Europe for international crimes under the principle of universal jurisdiction, a landmark that sent a striking signal to officials elsewhere: that senior government rank no longer functions as reliable insulation from accountability.

The principle is not, however, without friction. Selective enforcement remains its most persistent vulnerability. When powerful political relationships shape which atrocities receive scrutiny - and which do not - universal jurisdiction risks becoming something less than universal: a tool deployed against the isolated and weak while remaining largely inoperative against the connected and powerful.

The effects doctrine and economic regulation

In the realm of commerce, the effects doctrine has emerged as the primary engine of regulatory expansion. This doctrine holds that a country may regulate foreign businesses or practices if those activities produce substantial and intended effects within its own territory.

This is the cornerstone of modern antitrust and competition law. If two foreign companies merge in a way that stifles competition in American or European markets, those jurisdictions claim the right to review, block, or fine the entities involved - regardless of where the merging parties are incorporated or headquartered. The practical consequence is that multinational corporations must satisfy the most demanding regulator in any market where they maintain a significant footprint. In practice, this usually means the EU or the United States gets the final word, whichever applies the tighter standard.

Modern applications: from digital privacy to global finance

The practical application of these principles has created a world where "global" standards are often simply the national laws of the most powerful actors, applied outward. Nowhere is this more visible than in data protection, economic sanctions, supply chain governance, and criminal law.

Data protection and the GDPR effect

The European Union's General Data Protection Regulation (GDPR) is a masterclass in extraterritorial influence. By design, it applies to any company worldwide that processes the personal data of EU residents, regardless of where that company is headquartered or where its servers physically reside. A startup in Silicon Valley and a logistics firm in Seoul face identical compliance obligations if they serve European users.

Columbia Law professor Anu Bradford labeled this phenomenon the "Brussels Effect" - the process by which a single jurisdiction sets effective global standards by leveraging access to its lucrative internal market. Companies find it economically irrational to maintain two separate data architectures: one compliant with European standards and a different one for the rest of the world. The path of least resistance is to apply the stricter EU standard universally.

The results have been substantial. More than 150 countries have now adopted domestic privacy laws of some kind, and the majority bear a clear structural resemblance to the GDPR. What began as a European regulation has, through market logic rather than treaty negotiation, become the de facto global baseline for digital privacy.

Critics argue this amounts to regulatory imperialism - Brussels exporting its values through the back door of market access. Proponents counter that in a world where data flows are borderless, only a similarly borderless standard can meaningfully protect fundamental rights. Both views contain real force. The GDPR is simultaneously a genuine human rights instrument and a projection of structural power. These two things are not mutually exclusive, and the honest analysis requires acknowledging both.

The AI Act: the Brussels effect evolves

If the GDPR was Europe's opening gambit in regulatory projection, the EU AI Act - formally entering into force in August 2024 - represents its logical escalation. The Act applies to any AI system whose outputs are used within the EU, regardless of where the system was developed or the company behind it is domiciled. A research laboratory in Singapore, a startup in San Francisco, a manufacturer in Seoul - all fall within scope if their AI tools reach European users or employers.

The enforcement mechanism is deliberately punitive: fines of up to €35 million or 7% of global annual revenue for the most serious violations, whichever is greater. For a mid-sized technology company operating globally, those figures are not abstract. The effect, already visible in corporate strategy, is that many companies outside the EU are conforming to the AI Act's requirements even for non-European deployments - precisely the same de facto global standard-setting logic that the GDPR demonstrated.

The pattern is becoming a playbook. You do not need to be the world's largest economy to write its rules. You need to be large enough that exclusion from your market is commercially unacceptable, and rigorous enough that your standards become the floor everyone conforms to.

Economic sanctions as a foreign policy tool

The United States has long wielded extraterritoriality with particular force through its system of economic sanctions. The mechanism is elegant in its coercive logic: by targeting foreign entities that conduct business with sanctioned states or individuals, the US forces third parties to choose between maintaining access to the American financial system or continuing to engage with the sanctioned regime.

What makes this leverage extraordinary is the structural centrality of the US dollar in global trade and finance. A substantial proportion of international transactions are denominated in dollars and clear through the American banking system. This means that even transactions conducted entirely outside the United States, between two non-American parties, can fall within the reach of US sanctions authorities if a dollar-clearing step is involved.

The US Treasury's Office of Foreign Assets Control (OFAC) is the primary enforcement body. In recent years, it has extended secondary sanctions to Turkish logistics firms and Chinese technology companies for trading with entities supporting Russia - a significant expansion of enforcement scope that pushes the boundaries of what secondary sanctions have historically targeted. The message is deliberate: compliance is not optional, regardless of where a company is incorporated.

The EU, China, and Russia have each developed blocking statutes - legal countermeasures designed to insulate their own companies from being compelled to comply with American mandates. The EU blocking statute has been judged largely ineffective in practice due to persistent enforcement weaknesses. China's analogous framework - formally titled the Rules on Counteracting Unjustified Extraterritorial Application of Foreign Legislation and Other Measures, issued by its Ministry of Commerce in January 2021 and subsequently elevated to a State Council regulation in April 2026 - represents a more assertive legal posture, designed to neutralize US coercion rather than merely register objection to it.

This dynamic - superpower regulatory expansion meeting increasingly sophisticated legal countermeasures from rivals - has produced a fragmented global compliance landscape with no clear equilibrium in sight.

Supply chains and the CS3D: regulating global business conduct

A newer but rapidly consequential front in extraterritorial regulation involves corporate supply chains. The EU's Corporate Sustainability Due Diligence Directive (CS3D), formally approved by the European Parliament in April 2024 and entering into force in July 2024, imposes binding obligations on large companies operating in the EU market to identify, prevent, and remediate adverse impacts on human rights and the environment throughout their global value chains - including deep into their suppliers' operations in distant countries.

The extraterritorial logic mirrors the GDPR exactly: if you want access to Europe's market, you accept Europe's standards, including those governing your operations in Bangladesh, Vietnam, or Brazil. Non-EU companies with significant EU-linked revenues fall within scope and may be required to appoint an authorised representative inside Europe. Non-compliance can result in financial penalties of up to 5% of global turnover, making it one of the most expansive regulatory frameworks the EU has ever deployed in terms of extraterritorial reach.

For critics, the CS3D is another instance of the EU exporting its regulatory values through market leverage. For advocates, it is a long-overdue attempt to close the accountability gap between where corporate decisions are made and where their human consequences are felt. Whether it works in practice will depend heavily on enforcement capacity - a perennial weakness of ambitious extraterritorial regulation.

The Alien Tort Statute and human rights litigation

For decades, the US Alien Tort Statute (ATS) served as a distinctive portal for international accountability, allowing foreign nationals to bring civil claims in American courts for violations of the law of nations committed abroad. The statute has its origins in 1789, but its modern relevance was established by court decisions that opened American courts to victims of torture and other serious abuses perpetrated by foreign officials in foreign countries.

The ATS's scope has since contracted sharply. In Kiobel v. Royal Dutch Petroleum Co., the Supreme Court held unanimously in 2013 that the presumption against extraterritoriality applies to ATS claims. The case involved Nigerian nationals alleging that Anglo-Dutch oil corporations had aided and abetted the Nigerian government in committing human rights violations in Nigeria. The court established that alleged conduct must "touch and concern" the territory of the United States with sufficient force to override that presumption - a standard the facts in Kiobel plainly did not meet.

The decision reflected a deepening judicial discomfort with the prospect of American courts functioning as de facto global tribunals for foreign disputes. The message from subsequent jurisprudence has been consistent: the ATS offers a narrow channel, not an open invitation.

The friction of overlapping sovereignties

As more nations assert extraterritorial claims, jurisdictional conflicts multiply. The friction takes several concrete forms that complicate the lives of businesses, individuals, and diplomats attempting to navigate overlapping regulatory demands.

Conflicting legal obligations represent perhaps the most acute problem. A multinational corporation may find itself caught between Law A of Country X, which requires disclosure of certain data to government authorities, and Law B of Country Y, which makes that same disclosure a criminal offense. This legal pincer movement creates immense compliance risk and can paralyze investment in ways that benefit no one involved.

Sovereignty and the limits of legal persuasion generate their own friction. When a powerful nation exports its criminal or social values through law, it can be perceived as a form of political interference dressed in judicial clothing. The extraterritorial reach of anti-corruption statutes like the Foreign Corrupt Practices Act (FCPA) imposes a specific model of business conduct on global markets. While aimed at reducing graft, enforcement in countries where different commercial norms prevail creates its own secondary tensions.

The power asymmetry problem may be the most structurally significant. Extraterritoriality is not practiced symmetrically. Small and mid-sized nations rarely possess the economic leverage to project their regulatory standards onto foreign actors. The practice is overwhelmingly the domain of economic superpowers - the United States, the European Union, and increasingly China. This creates a two-tiered international legal system in which some countries write the rules and everyone else must comply with them.

The challenge of enforcement and accountability

Asserting jurisdiction and enforcing it are two very different things. A state may levy a multi-billion dollar fine against a foreign entity, but if that entity maintains no physical assets or operations within the state's borders, the judgment may amount to little more than a symbolic declaration. This gap drives regulators to target strategic choke points in global infrastructure - bank clearinghouses, payment processing networks, internet service providers - where the physical anchoring of digital commerce allows legal leverage to find traction.

There is also a deeper question of democratic legitimacy. When a legislature in one country passes a law that materially affects the lives of people who had no vote and no voice in the political process that created it, something uncomfortable is happening in relation to principles of self-governance. The phenomenon resembles taxation without representation on a global scale: burdens are imposed on populations who had no means of contesting or influencing their imposition.

This is not a hypothetical concern. Thousands of companies - and by extension, millions of employees and consumers - in countries like India, South Korea, or South Africa are today shaping their business practices in response to regulations adopted by democratic assemblies in Brussels or Washington where they are not represented and have no standing.

Judicial restraint and the presumption against extraterritoriality

Recognizing these dangers, many legal systems have developed internal constraints on jurisdictional expansion. In the United States, the presumption against extraterritoriality functions as a canon of statutory interpretation: unless Congress explicitly indicates that a law is meant to apply beyond American borders, courts presume it does not. The doctrine exists to prevent inadvertent diplomatic friction and to keep the judiciary from straying into territory that belongs properly to the executive branch's conduct of foreign policy.

Maintaining that presumption has grown harder. In a digital economy, the concept of "location" is genuinely contested. When a server in Iceland stores data from a user in Florida accessed through a company incorporated in Ireland, the question of which nation's law applies does not yield a clear answer from first principles alone. Courts are increasingly forced to look at the focus of a statute - asking whether the core regulated activity took place at home or abroad - rather than applying rigid territorial tests.

This shift acknowledges something important: in a globalized world, the effects of conduct frequently matter more than the physical coordinates of the actor. It is a pragmatic adjustment, but it also quietly expands the scope of what can be claimed as domestic legal concern.

The internet as a catalyst for jurisdictional chaos

The borderless architecture of the internet has accelerated extraterritorial disputes in ways that expose the inadequacy of existing frameworks. A single judicial order can have immediate global consequences - creating a dynamic where the most restrictive legal standard in any jurisdiction can potentially dictate what everyone in the world sees, accesses, or transmits.

The Google Inc. v. Equustek Solutions Inc. case illustrates this with striking clarity. A Canadian company obtained a court order requiring Google to remove websites from its global search results - not merely from the Canadian version of the site - to protect misappropriated trade secrets. Canada's Supreme Court affirmed the order. Google then sought and obtained relief from a US federal court, which enjoined enforcement of the Canadian order on the basis that it conflicted with American law protecting internet intermediaries. The result was a direct collision of two legitimate national legal orders with no overarching authority to resolve the contradiction.

Cybercrime presents even more complex challenges. When a hacker in one country attacks a financial institution in a second country using infrastructure hosted in a third, the question of who has the right to investigate, prosecute, and extradite is genuinely difficult to answer. The Budapest Convention on Cybercrime - the primary multilateral instrument in this space - explicitly limits enforcement jurisdiction to each state's own territory, which is precisely the limitation that makes transnational cybercrime so persistently difficult to address.

The UN General Assembly adopted a comprehensive global cybercrime convention on December 24, 2024, marking a significant milestone. But the treaty has already drawn pointed criticism from civil liberties organisations, who argue that its broad substantive scope - extending well beyond attacks on computer networks to encompass international cooperation for a wide range of crimes - combined with insufficient human rights safeguards, could enable states to assert unprecedented cross-border surveillance powers. Human Rights Watch warned that the convention could be "primed for abuse," and the concerns were amplified by the fact that the treaty's origins lie in a 2019 resolution initially sponsored by Russia. Whether the convention ultimately narrows the jurisdictional gap or expands state authority in troubling new directions remains genuinely uncertain.

How small states navigate an asymmetric system

The structural asymmetry of extraterritoriality is not merely an abstract diplomatic grievance - it has direct operational consequences for governments, businesses, and individuals in smaller economies. Countries with no plausible mechanism to project their own regulatory preferences outward are nonetheless subject to the regulatory preferences of those who can.

For many nations, the practical response involves a combination of strategies. Regulatory alignment - voluntarily adopting the standards of powerful trading partners to maintain market access - is by far the most common, even where no formal obligation exists. Compliance arbitrage, the practice of structuring operations to minimize exposure to the most demanding jurisdictions, is widespread in financial services and data-intensive industries. And diplomatic negotiation, seeking carve-outs or transitional arrangements within the frameworks set by major powers, is the standard recourse for governments that find compliance obligations particularly burdensome.

None of these is a satisfying long-term answer. Regulatory alignment effectively cedes standard-setting authority to outside powers. Compliance arbitrage creates perverse incentives and is increasingly squeezed as enforcement tightens. And diplomatic negotiation, in a world of deeply unequal bargaining power, tends to produce modest adjustments at the margins rather than meaningful structural change.

The result is that the international regulatory landscape increasingly resembles a tiered architecture: a small group of rule-writers at the top, a large group of rule-takers in the middle, and a set of informal norms at the bottom that reflect power rather than consensus.

Towards a new framework of international cooperation

The current architecture of extraterritoriality is, at its core, a system of high-stakes improvisation. States extend their reach where they have the power and the interest to do so. Other states comply, retaliate, or attempt to insulate themselves through blocking statutes. There is no global arbiter, no settled hierarchy of competing claims, and no principled mechanism for resolving the contradictions that accumulate when multiple legal systems assert authority over the same conduct.

This ad hoc system does, at times, serve important purposes. Extraterritorial reach has been used to prosecute war criminals, disrupt financial networks that fund atrocities, protect the personal data of millions of people, and hold corporations accountable for harms inflicted through global supply chains. These are not trivial achievements.

But the costs are real: legal unpredictability, cascading compliance burdens, diplomatic friction, and the deepening perception in much of the world that international law is simply the will of the powerful dressed in the language of universality.

The path forward almost certainly requires strengthening the multilateral infrastructure that could reduce dependence on unilateral extraterritorial assertions. We see the beginnings of such infrastructure in the Basel Accords for banking regulation and the Paris Agreement for climate, but these frameworks remain either non-binding or limited in scope, and they cover only a fraction of the contested territory that extraterritoriality now occupies.

For extraterritoriality to function as a sustainable instrument rather than a source of permanent tension, it must be tethered to two principles: genuine connection - a meaningful link between the regulating state and the regulated conduct - and comity - the legal courtesy by which states recognize, rather than simply override, the legitimate authority of other legal systems.

The question of who gets to govern a world without walls is one of the defining legal and political challenges of the coming decades. Extraterritoriality is the mechanism through which that question is currently being answered - unevenly, incompletely, and often without sufficient accountability to those who must live with the results. Understanding how it works is not merely an exercise in legal theory. It is, increasingly, a prerequisite for understanding how power actually operates.