> is subject to GDPR if they are interacting with EU citizens.

Only with regarding to item a and b. Item b is irrelevant since it's for monitoring EU citizens within EU. Item a is questionable since it's for goods and services offered, i.e. marketed to, EU citizens. For non-EU companies and websites that don't market to or offer goods/services to EU citizens, I don't see how GDPR applies.