this is actually true, while in theory EU says GDPR applies abroad, it simply doesn't because its not law of the land. Only indirectly can it be enforced, e.g. a US based payment processor would want to comply because otherwise EU businesses would not be able to use it.