I’m fairly concerned about how broadly some are interpreting “operating in the EU”.
The furthest this has gone that I’m aware of is the Dutch, alongside other EU authorities, has issued a fine to an American website, alleging that they subject themselves to EU jurisdiction by merely hosting information about EU citizens. This seems to me to be too far.
https://edpb.europa.eu/news/national-news/2021/dutch-dpa-imp...