Whenever a E.U. citizen visits a website, GDPR applies, so the rule applies wherever is “located” the website …
The beauty of extraterritoriality just like the C.L.O.U.D. act (Clarifying Lawful Overseas Use of Data Act).