I think you'll find that GDPR says the opposite and the only reason this continues to happen is because authorities don't have enough resources to go after every at the same time and also because European authorities have a hard time against US companies.
I think you'll find that GDPR says the opposite and the only reason this continues to happen is because authorities don't have enough resources to go after every at the same time and also because European authorities have a hard time against US companies.