This is a bit pedantic, but I'll make my point anyway: whether a law can apply to you is orthogonal to whether it can be enforced on you. The GDPR is very clear

This is a bit pedantic, but I'll make my point anyway: whether a law can apply to you is orthogonal to whether it can be enforced on you. The GDPR is very clear about its application, and it is explicitly extraterritorial [1]. Of course, it does have secondary provisions about company size and non-commercial activity (mainly recitals [13] and [18]) which limits its applicability, but from a legal definition point of view, "I don't live in the EU so the GDPR does not apply to me" is too simplistic. [1] https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/ [13] https://gdpr-info.eu/recitals/no-13/ https://gdpr-info.eu/recitals/no-13/ [18] https://gdpr-info.eu/recitals/no-18/ https://gdpr-info.eu/recitals/no-18/