Does it have to be a company in the EU? I thought the GDPR covered any website an EU citizen, resident, or visitor might use, in which case US-based websites might have contradictory obligations to the GDPR and US law.
https://gdpr-info.eu/art-3-gdpr/
Just because a website exists and may be visited by a EU resident, does not mean that the site automatically has to comply.
It could be argued that such an act "falls outside the scope of Union law;" but that seems to be a matter of contention.
1. They are the legal justification for legislating; The EU is not sovereign, so it cannot legislate of its own accord, the EU must show that the legal powers flow from the treaties. So recitals set out which provisions of the treaties apply, and why the legislators think the law is necessary under them.
2. They are an aid to interpretation; the main body of the law should be read "in the light of" the recitals to understand the legislators' intent and to help ensure there is a consistent application of the law between all of the different courts and tribunals in the EU. These recitals are, of course, not part of the actual legal text and are thus not binding, but they're not inoperative.