Well, they'd be incorrect in any but the strictest sense.
Whatever the US wants to enforce, gets enforced. The DMCA, for instance.
And a small company might be able to ignore the gdpr, but the owners would still potentially get in potentially serious legal trouble. There are quite a lot of extradition treaties in the world.
That being said, the EU has been very slow on gdpr enforcement so yeah, it's currently toothless.
Whatever the US wants to enforce, gets enforced. The DMCA, for instance.
And a small company might be able to ignore the gdpr, but the owners would still potentially get in potentially serious legal trouble. There are quite a lot of extradition treaties in the world.
That being said, the EU has been very slow on gdpr enforcement so yeah, it's currently toothless.