Yes. US law says in no uncertain terms that the us government can demand anything from its companies, including breaking the law in foreign countries. And that was before big tech decided to collude with an administration who doesn’t care about the law.

For US companies to be in the clear, they would have to split their EU subsidiaries in such a way that the US branch could not access their EU operations or ship new patches, and would not have operational oversight.

Technically they also have EU daughter companies operating this services etc. this are legally seen EU companies and have to strictly comply with EU law no matter what US law says.

But US law like cloud act is a broad overreach of US law into other countries.

Which puts them into a tough spot where there parent company has to comply with US law and give US access to their EU daughter company but their daughter company must not allow them such access at all and if they would use technical means to get it anyway it would be legally no different then a cyberattack....

That was their trick to circumvent the Patriot Act.

But then came the CloudAct and the location doesn’t matter anymore.

You do business in the US, you have to provide the data.

It's not the physical location of data that matters, it's the authority and control over the infrastructure and the data it holds.

In other words, if a US authority has any say on what's running/hosted in data centers in EU, it's a no go for more and more businesses and administrations.

And what about EU headquartered cloud providers that have servers in the US like Hetzner?

If you use AWS in Europe your invoice is from Amazon Luxembourg...