That's correct, however the GDPR contains some clauses allowing each state to pass national laws to supplement it, and I expect most states will.