That’s the big part of what makes GDPR so wide-reaching and impactful. It protects European residents, not European IP addresses. If you’re a resident of Europe, you’re covered under GDPR. Even if you’re visiting the US. That’s why even Americans get GDPR questions when visiting sites, because the site can’t just filter by IP location to determine whether or not you need to be shown the GDPR prompt.

Enforcement can be trickier, sure. But to be clear, GDPR does cover non-European companies as long as they’re interacting with a European resident.