Basically, the US is not compliant with GDPR because of a couple of laws, which I've forgotten the name of. Some courts have found that because the company is US then even if the data is in the EU a US court can force the company to hand it over. This is why Google Analytics is illegal in a few countries.