But they only have to actually follow GDPR for European users, right?
Most articles I've read on it state the user must be in Europe and taking a product/service delivered to Europe. A US tourist buying something in a store when they arrive in Europe has GDPR protection, a French tourist visiting the US (or even at home in France but buying something online to be delivered to a friend in the US) is not.