In reply to European.

Which means that for some European countries and some European citizens EU rules don’t apply, and thus GDPR.

That's not the case if a non-EU entity transacts with or manages data for EU entities, i.e. GDPR will apply. You can choose not to adhere to GDPR, but if your EU footprint is large enough then expect enforcement. The EU has messed up before, both the cookie law and VAT MOSS, but GDPR is well thought-through and already law in all EU countries; it's just enforcement that starts this year.

IMO this should be viewed as an opportunity to review how you treat your users and deal with their data.