I thought US companies had to agree to Privacy Shield if they wanted to be considered GDPR-regulated.

https://www.privacyshield.gov/welcome

Why any US company would voluntarily agree to this is beyond me, unless one of its EU customers insisted on it.

The EU says it applies but, AFAICT there’s no legal mechanism by which it applies.

Here’s a lawyer’s take on this: https://tinyletter.com/mbutterick/letters/you-re-not-the-bos...