Targeting: say you are sitting in Paris and buy from a book store in the US. If that book store does not have a site in French, show prices in euros, or advertise in the EU; the fact that it is willing to, on a limited basis, ship to France almost certainly means it is not subject to GDPR.
Even the fact of offering prices in Euros is the subject of an active court case as to whether that counts as targeting.
Enforcement is going to be difficult for companies owned and operating entirely outside the EU. Of course that doesn’t apply to T-Mobile.
It does apply as GDPR has no geographical limit according to the EU but they have to catch you and be able to prosecute which isn't going to be a straight pathway unless the business operates in the EU somehow.
I've always wondered that about GDPR compliance. Once your company has gone through all the effort and expense to comply with GDPR, why take on the additional expense and complexity trying to conditionally apply all this new business logic only to EU people? Wouldn't it be simpler to just use your GDPR-compliant business logic for everyone? Why maintain EU and non-EU silos?
It's like squaring the circle.