I am not a lawyer, but GDPR compliance looks like it doesn't quite apply due to not necessarily being targeted at European citizens https://gdpr.eu/companies-outside-of-europe/
I haven't dove into it since the initial panic around how far it would reach, and the work I've done at work to accommodate it at work, but my understanding was that just by providing the service to EU citizens (i.e. you haven't IP banned the entire euro region) you are liable to face penalties. I'm probably just talking about of my ass though. IANAL