I think the law is not well-defined because, as you mentioned, any visit to a country that doesn't provide that same data protection rules should be blocked bas

I think the law is not well-defined because, as you mentioned, any visit to a country that doesn't provide that same data protection rules should be blocked based on the current law. Also, I still find it weird that the EU (GDPR) laws apply at the client (visitor) rather than at the source (server). The question is: is the server providing a service in EU (sending a webpage) or is the client "going" to a server in the US?