Edit: making clearer, including text from the law. You inadvertently highlight one of the main issues with the GDPR: unclear guidance. From the "Does the GDPR

Edit: making clearer, including text from the law. You inadvertently highlight one of the main issues with the GDPR: unclear guidance. From the "Does the GDPR apply to companies outside of the EU?" page at gdpr.eu: "If your organization uses web tools that allow you to track cookies or the IP addresses of people who visit your website from EU countries, then you fall under the scope of the GDPR. Practically speaking, it’s unclear how strictly this provision will be interpreted or how brazenly it will be enforced. Suppose you run a golf course in Manitoba focused exclusively on your local area, but sometimes people in France stumble across your site. Would you find yourself in the crosshairs of European regulators? It’s not likely. But technically you could be held accountable for tracking these data." Even their explanation is not clear. Notably, it's different from your understanding of whether it would apply. Which: I don't blame you, the law is not explained well anywhere I have seen. And their conclusion of "Not likely. But technically..." is not sufficient as official guidance. What if we go to the law itself? " 2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union. " Section b doesn't have the carveouts you asserted. Is that exemption in one of the other 98 articles, or an amendment, or elsewhere? Or does it not formally exist? If the hypothetical US ski resort uses e.g. Stripe that allows people to pay in whatever payment mechanisms are common in their countries, does that alone mean I am "targeting" EU residents? What if my billing page allows a customer to select Belgium in the billing address? What if I don't block shipping addresses in the EU? The intent here is not to litigate this to death, but rather to point out that the reason so much of the understanding of the law is contradictory is that the thing itself is complex. People don't want to get sanctioned, and putting cookie banners on sites is a way to prevent sanctions.