Thanks for the corrections.

What my original statement meant to convey was not simply disagreement with GDPR, but more that two somewhat unrelated edge case decisions ("do 'just' IP addresses count as PII", and "can one work with American suppliers") gave this regulation a scope that I believe wasn't even intended by the original lawmakers (as evident by their own failure to be compliant, see other comment thread), and that very much goes against the realities of the Internet of the past 25 years.

That being said, your corrections are valid and give a more precise description of the situation rather than my initial comment.