I still find it confusing that you can both claim to be GDPR compliant and also that only US law apply to your operations. Automattic was also claiming compliance via the EU-US Privacy Shield which had already been made invalid by the European Court of Justice for a while.