They're not insisting on keeping European user data in Europe, though. They've simply concluded that US surveillance laws provide too few protections to non-US citizens living in Europe for their data to be transferable to the US, and that neither Privacy Shield not Standard Contractual Clauses can overcome that.

The EU still allows transfering data to other third countries if suitable protections can be effectively put in place, whether through some governmentally agreed program like what Privacy Shield tried to do or through Standard Contractual Clauses. They simply view the laws in the US as too hostile to most of their residents' data privacy rights. ("Most" instead of "all" because US citizens have more protections under US law even when living in Europe.)

So, while sure it is a kind of border, it's a "privacy-protected vs privacy-dangerous" border rather than a blanket "us vs them" border. Or, phrased another way, it's not a border as a goal, but rather preventing the nature of the internet from overriding their separate privacy goal. I am fine with that attitude.

The concept is still worryingly dangerous given the precedent of "Can't move data outside our jurisdiction" could easily be applied to limit security and ensure snooping instead of preventing it. Given the usual habits and hypocrisies trusting them as far as you can throw them remains wise.

Sure, but even now they're not saying "Can't move data outside our jurisdiction". They're just saying "if you move data outside our jurisdiction, you must put in place suitable safeguards to protect our residents' privacy - and this requirement is currently impossible to meet in the US". There are enough third countries worldwide where the laws would allow, for instance, the Standard Contractual Clauses plus suitable due diligence in practice by the parties concerned to make legal transfers outside of the EU.

In this case, borderless tracking and surveillance.

I mean yes, but also the idea that a company in country X can operate a website usable by people in country Y without having to stand up/rent space in a data center there.

Which would be perfectly fine if only the US had adequate privacy regulation.

IMO it would also be perfectly fine if Facebook wasn't running any EU servers, was solely a US company, all use by EU users intrinsically sent data to the US, and were protected (or not) by US law. That would actually be the "borderless Internet". But that is not how they've set things up.

GDPR applies worldwide to EU citizen data regardless of where the servers are located.

They are free to reduce tracking user data globally, they don't have to apply it only to the EU.

I still believe in the ideal but also recognize that the dream is most likely over for now, and I think rightly so. Superficially the situation looks like what cattle ranching went through in the American West with free grazing [0]. The internet is no longer a handful of small ranchers that can come to low cost solutions with the people they might impact. Even if there were no Facebook type ranchers, there'd be enough small time guys to warrant fences and collective action.

[0] https://en.wikipedia.org/wiki/Open_range

One can have a borderless internet without having borderless companies.

Let's take Facebook. We could have Facebook.US, Facebook.EU, Facebook.UK, Facebook.CN, etc.

In a borderless internet, you'd still be allowed to use the one that you wanted, but each would be subject to the laws of its "country". (I realize that the EU isn't a country.)

So what laws is the interaction between users in different countries governed by?

You see data protection as a border?

Data for people in $country must stay in $country is essentially a border. It’s not about the actual protections but the fact that the EU considers data that would be legal to collect and store in the EU illegal to store in the US.

Well if data wasn't being mishandled, poorly managed and devalued without any legal repercussion we wouldn't have reached this point.

Plus it's not in $country is in $region, if all countries made an effort to adopt GDPR data could be stored anywhere.

EU is looking for their citizens data, since no one else seems to care that much (other than China but for completely different reasons).

Unless you think that the protocol of tech giants to poor data protection is fine, when they are saying:

"Ups, we're sorry :(... it won't happen again!"

Borderless with users behind a walled garden where their personal data is mined like gold.

Yeah that’s part of the original vision of the Internet.

if profits from this borderless internet are not borderless, then there is little incentive for a borderless internet.