U.S. law applies, just like normal, unless the website is located in the EU. The EU claiming jurisdiction over transactions entirely in another country would b

U.S. law applies, just like normal, unless the website is located in the EU. The EU claiming jurisdiction over transactions entirely in another country would be a major breach of sovereignty, which is why the law uses the phrase "data subjects in the Union". Note that EU law does apply for visitors, so look forward to data tourism!