A U.S. company faces GDPR obligations only if it intentionally “targets” people in the EU—through European-language
marketing, EU domains, EU payment or shipping options, or dedicated contacts. Minimal incidental access (e.g. a
European visiting the site) generally does not trigger GDPR.

Read More Here.