I think you're understating how much of this law is about EU resentment of US tech companies' mindshare and marketshare.
But we get to "protect our companies" as a matter of policy.
Cool.
Just because many companies and startups are U.S.-based, does not mean that universal privacy laws/rights are targeting U.S. companies.
From my understanding, the GDPR applies equally to all companies, regardless of where they are founded.