Other users have written about GDPR, but just FYI: There are a lot of laws that apply worldwide. You might not like it, but states really do have laws in place that they are applying to everybody in the world. Thailand has draconian laws about insulting their king and they totally do not care if you insulted him inside or outside of the country. They can't arrest you whereever you are, but if you ever try to visit Thailand, you will get arrested. And many countries also have laws in place about stuff that their citizen do outside of the country.

That’s the big part of what makes GDPR so wide-reaching and impactful. It protects European residents, not European IP addresses. If you’re a resident of Europe, you’re covered under GDPR. Even if you’re visiting the US. That’s why even Americans get GDPR questions when visiting sites, because the site can’t just filter by IP location to determine whether or not you need to be shown the GDPR prompt.

Enforcement can be trickier, sure. But to be clear, GDPR does cover non-European companies as long as they’re interacting with a European resident.

Wrong. US citizen while in EU falls under GDPR. EU citizen while anywhere outside of EU falls under GDPR.

It is up to EU to enforce it.

That's kind of the nature of laws.