That's not true. Transfer to third countries is legal, as long as you _properly_ inform people of the risks that it poses, and it's completely voluntary:

> finally, if a transfer of personal data is envisaged to a third country that isn’t the subject of an Adequacy Decision and if appropriate safeguards are absent, a transfer can be made based on a number of derogations for specific situations for example, where an individual has explicitly consented to the proposed transfer after having been provided with all necessary information about the risks associated with the transfer.

https://ec.europa.eu/info/law/law-topic/data-protection/refo...