GDPR says IP Addresses are personal data, although this is a clarification of a previous court ruling.
Personal data does NOT need consent to process. Consent is only necessary in a minority of cases, and certainly not regular website access. The idea that GDPR <==> is a misunderstanding. (This is closer to true when dealing with website cookies, because of a different and stupider law.)
GDPR does not prevent transferring data outside of Europe. It just says that data privacy must be respected, in one of a variety of ways. The problem is the US CLOUD Act, which basically says US companies are bound by US law even when operating in other jurisdictions. EU Courts have ruled that US companies bound by the CLOUD Act cannot safeguard data. And they aren't wrong.
By comparison, data transfers to the UK or Japan require nothing more than putting the words "adequacy decision" in your privacy policy. This is because those countries have laws safeguard privacy, as opposed to laws safeguarding law enforcement's access to personal data.