GDPR applies if you are a European citizen visiting a website while on holiday in USA, for example. It doesn’t seem to me that GDPR stops when crossing a border. Which is why it has so much worldwide reach.