They can't be GDPR compliant if they can't prevent US three letter agencies from accessing their data - or more to the point, EU citizien need to be able to get to court with US three letter agencies to administer their rights, which they can't for various reasons, one of them that they don't know because the US has secret courts.