If you were to only offer your service in North America, but someone from the EU comes over to North America on vacation, and somehow becomes recorded in your service.
Does the GDPR still apply in this case?
Article 3 defines the territorial scope:
http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELE...
Yeah. Good luck with that.
It'll work for the big, entrenched companies like Facebook who couldn't bear to be without its UK customers, for example. But I don't see the EU successfully going after every little dot-com startup from Alabama to Angola, many of them in jurisdictions that barely have a functioning legal system, let alone respect for EU law.
If such extraterritorial enforcement was actually possible, there would be no 419 scammers.
If a company even stores a record of a single EU citizen, the GDPR applies to it, and the EU has the right to seize the assets of the company for the purpose of enforcing it.