Basically the GDPR considers anything that's accessible or marketed to EU residents (not citizens) under its jurisdiction. In practice this is (probably) pretty much every side that isn't a local business or specifically blocking visitors from the EU.