Look up the cloud act. It essentially makes it impossible for any US company to truly comply with GDPR.