The GDPR can state whatever it wants but what are the consequences? If the taliban pass a law about what is required to serve websites in Afghanistan, for instance, what obligation am I under to even notice?

If I am Reuters and AP and have offices in EU of course I am interested in complying with local law, but it doesn’t make sense to me for a local newspaper to care whether they are in compliance with foreign statutes.