One weird GDPR implication our team considered during initial implementation of our solution was US citizens traveling to Europe, and even people visiting embassies of EU countries in the US, would seemingly trigger all applicable constraints of the legislation.

Personally, I still view GDPR more akin to regulatory capture than actual consumer protections; although, I do admit, more than anything, the Internet needs more consumer protection.