(I originally asked this question on Server Fault with GDPR tag, but due to minimal response was advised to try asking here)
As I understand it, GDPR is European legislation promoted as protecting EU citizen's privacy and granting EU citizens rights to control how websites use data/whether the websites can store said data.
My initial impression of GDPR is that if an EU citizen wants GDPR rights, they should only use servers residing in the EU which would be subject to GDPR legislation.
However, there apparently is some notion that EU legislation can somehow affect servers outside of the EU? I'm not a lawyer, but I would expect that each nation defines and enforces their own laws -- which may or may not be in alignment with another nation's legislation. How is GDPR even applicable to servers residing in the US (or any other non-EU nation)?
Based on several articles I've read online, it seems somehow the US allows EU's GDPR legislation to be enforced on US soil.
Since I don't want to deal with GDPR headaches, I seemingly have no choice but to block ALL EU citizens (and anyone else accessing my sites/services from within the EU) from using my websites and services. I can firewall the entire EU IP address space to catch the bulk of EU users, but there are EU citizens who could use VPN or otherwise access my site from an non-EU ISP.
Is there a legal approach that can be used to block EU citizens? E.g. "Accessing this site or service as an EU resident is illegal" such that if one violated the legal directive, GDPR expectation would be void? I don't care if they use my websites and services as long as they understand I'm not playing the GDPR game and anything they submit to my servers won't be subject to it.