Hmm. I hope you are aware that GDPR has extraterritorial jurisdiction, enforced via any data controller or processors you are using that have a presence in the EU. Did you remember to check all your boxes there too?
2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:
a. the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or
b. the monitoring of their behaviour as far as their behaviour takes place within the Union.
3. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.
It may be in the GDPR’s text but they have no jurisdiction. Put simply, the EU has no authority whatsoever to create law outside of its own borders.
To instrument with which to extend the reach of such laws as the GDPR would be international treaties.
Only with regarding to item a and b. Item b is irrelevant since it's for monitoring EU citizens within EU. Item a is questionable since it's for goods and services offered, i.e. marketed to, EU citizens. For non-EU companies and websites that don't market to or offer goods/services to EU citizens, I don't see how GDPR applies.