This is a great point actually... the GDPR law specifically applies to holders of EU passports. If your website clearly disallows EU citizens, ie: a popup stating "You are not authorized to access this website if you are, or plan to become within the next 2 years, an EU citizen", are you being compliant with GDPR? Or is there simply no way to be GDPR compliant if you store any personally identifiable data?

I won't get into intentions, but it seems like the law is so broad that it just allows any EU government to selectively enforce the law and collect fines from any company they choose...