I don't think this is true. It's not totally clear but GDPR seems to require people to be in the union. I believe that residency is the main requirement, not citizenship (a German person living in the US dealing with a US-only company is not covered).

Seriously? I did not know that. How would that work?

Edit: Just read Wikipedia and another source and both define it for people within the EU. They do mention whether the company is outside the EU and how they would need to handle the data for people within the EU.