> That only applies if both the sender and receiver are in the EU.

I'm under the impression that GDPR Article 3 (2) does apply in the case at hand, which is marketing emails sent by a US company to an EU resident.