The GDPR doesn't apply to most of the world, it's awful legislation anyway. It's not your data, it's my data about you, I own it, it's in my databases, and if you don't want me to have it, you shouldn't have given it to me freely to begin with.
The opening paragraph of the article:
> Nervously, I gave a bounty hunter a phone number. He had offered to geolocate a phone for me, using a shady, overlooked service intended not for the cops, but for private individuals and businesses. Armed with just the number and a few hundred dollars, he said he could find the current location of most phones in the United States.
Do you own a phone?
And there you have the main difference between European and US laws and mindset. Because it is my data, you are only allowed to store it in your database as long as I say you can, and you can only use it for what I have agree on. Since it is my data you cannot give or sell it to anyone else