Yes, that is basically the idea. it can only be enforced for european citizens, but everyone must comply.

> everyone must comply.

Enforcement is going to be difficult for companies owned and operating entirely outside the EU. Of course that doesn’t apply to T-Mobile.

Imagine a local store with a simple website but purchasing is done all in-store. They ask for your email address and record your credit card information at an in-person sale. They'd be in non-compliance if you were an EU citizen (if they didn't conform to GDPR), or? Or does this not apply being not in reach of EU laws?

> Or does this not apply being not in reach of EU laws?

It does apply as GDPR has no geographical limit according to the EU but they have to catch you and be able to prosecute which isn't going to be a straight pathway unless the business operates in the EU somehow.

Once you've complied, why not apply it to every user?

I've always wondered that about GDPR compliance. Once your company has gone through all the effort and expense to comply with GDPR, why take on the additional expense and complexity trying to conditionally apply all this new business logic only to EU people? Wouldn't it be simpler to just use your GDPR-compliant business logic for everyone? Why maintain EU and non-EU silos?

Sometimes it's not possible, just look at the CloudAct. It's incompatible with GDPR and still they try it with useless agreements like Privacy Shield and Safe Harbor.

It's like squaring the circle.