"As per Article 3 of the GDPR, the territorial scope of the GDPR applies to businesses regardless of whether the processing takes place in the European Economic Area (EEA)." (https://www.cookieyes.com/blog/gdpr-in-the-us-a-checklist-fo...)