The question is raised of whether the EU is acting with the goal to raise rights protection standards for the global community in its exercise of extraterritorial jurisdiction in the data protection sphere. The research conceives of the EU’s exercise of jurisdiction as falling somewhere into three categories along a spectrum: pure rule diffusion (third States enacting laws to trade with the EU), consequential norm diffusion (third States striving for strong data protection having internalised these laws), or full norm export (the EU actively spreading a high data protection standard globally). First, the EU has used its market leverage to influence third State law. Second, the EU’s actions could incidentally ratchet up global data protection standards and start to take on more of a normative character; it could be consequential norm diffusion. Third, although initially appearing parochial, the EU increasingly sells its data protection regulation worldwide as the gold standard. Consequential norm diffusion, as opposed to self-proclaimed norm export, is the most effective way of spreading values in practice, but the EU also has responsibilities not to exercise jurisdictional overreach in viewing its role solely as an exporter of a strict data protection norm.