> GDPR is a foreign law that has no relevance to American firms lol.

I couldn't agree more with the spirit of your comment, but sadly the reality may be somewhat more nuanced:

GDPR in the USA https://www.cookiebot.com/en/gdpr-usa/

"The GDPR has extra-territorial scope, which means that websites outside of the EU that process data of people inside the EU are obligated to comply with the GDPR. ... In fact, the very first GDPR enforcement was against a Canadian company... being a website in the US does not exempt you from GPDR compliance and the territorial distance will not protect you from its enforcement either."

Reminded me of:

CISA amendment would allow US to jail foreigners for crimes committed abroad https://www.theguardian.com/technology/2015/oct/22/cybersecu...

There's no sadly here, it's the opposite. In your world Facebook could still abuse European's privacy.

In my world, I would not be committing a crime if I, someone who has never stepped foot in Asia, criticised the Chinese Govt.

https://www.axios.com/china-hong-kong-law-global-activism-ff...

In other news, a company selling a GDPR compliance service is trying to scare companies into buying their service. Shocking to see!

In reality, a US business with no EU presence only has to follow US laws. The only "enforcement" power the EU has would be to order the website to be blocked in the EU, and I'm pretty sure they can't even do that.