It means they're tracking US visitors in ways intrusive enough to be illegal in Europe, yes.

Maybe. Maybe not. Regulatory compliance is orthogonal to security and privacy. Just ask PCI folks.

It means they're not complying with European Union laws. Whether you think complying with a law is synonymous with protection, or security or privacy is up to your experience and worldview.