They don't, they don't even apply to EU citizens keeping their (our, in fact) data on our (EU's servers) if what we're doing happens to cross some interests of the US Government. I mean, there are some legal "protections" in place for that, but notice the quotes. Thinking otherwise is delusional, but, hey, people should be allowed to enjoy the liberty of their slightly larger iron bird-cage.