Show me where GDPR only applies if I specifically target EU citizens. I was under the impression that it applied if somebody in the EU visited my website.
Generally, GDPR prohibits the transfers of personal data from the European Union to a country that does not meet the same privacy protection standards as those provided by the European Union. Due to a lack of uniform privacy laws that provide significant privacy rights to individuals and the surveillance of United States intelligence agencies, the European Union has long held that the United States does not provide adequate privacy protections to individuals.
It seems like e.g. the US CLOUD act requires US businesses to provide their agencies access to any data, whether that data is hosted in the US or not. IANAL but this looks to me like even if Google uses EU based servers to host fonts, they would still be required to provide PII to US agencies.
There are other non-EU countries in the world with GDPR compatible regulations.
Edit: Also the more I read about the GDPR (and the CLOUD act), the more I'm in favor of it.