[throwaway210222]

> A US company can be compliant. They just have to host EU user data in the EU.

Actually since the 2018 Cloud Act, no US company can be ever be GDPR compliant.

Here is a possible sequence of events:

1. the US has secret courts (FISA, 1978)

2. and these courts can insist on access to EU hosted data (CLOUD Act, 2018)

3. its illegal for a US corp to indicate whether such access has been demanded

4. so a FALSE 'no' must be the answer to an EU data subject asking about access to his/her data

5. which is a breach of the GDPR.

Everyone knows this. They just ignore it. The EU ties itself in knots (Schrems II) trying to justify all of this.