Yes, and that sucks. Adding more overly broad extraterritorial laws is going in the wrong direction.

Note that a common response by foreign banks to FATCA is to refuse to do business with Americans, which is very likely the best course of action. So it shouldn't be surprising when companies take similar precautions because of GDPR.

There seems to be a big difference between enforcing a law on all financial institutions and enforcing a law on all websites basically that serve the EU. The latter seems next to impossible to enforce.

FACTA is why banks refuse US citizen or PR customers.