Jurisdictions are incredibly important in law, and the EU has no jurisdiction over US companies. If US companies want to do something that goes against GDPR, it

Jurisdictions are incredibly important in law, and the EU has no jurisdiction over US companies. If US companies want to do something that goes against GDPR, it's on the EU to prevent their citizens from accessing those companies' websites/apps. But once they are accessing that company's app, the fact that they're an EU citizen doesn't change the legal obligations of a US company whatsoever. Now, it makes sense for multinational corporations to have GDPR-related functionality since some of their assets are under EU jurisdiction and for them it's probably safer (if lazy) to do it across the board. But if you're not in the EU and you run a one-person SaaS app or something, you have zero reason to jump through any GDPR hurdles if you don't want to. The EU doesn't suddenly gain jurisdiction over your business processes because an EU citizen types your address into the URL bar.