This is my favourite bit of GDPR (so far), from a US site:

" Sorry ;-(
You are visiting this website from a country belonging to the European Economic Area (EEA) which enforces the General Data Protection Regulation (GDPR) and therefore cannot grant you access at this time. We are unable to bear the GDPR compliance cost at the moment. Come back again some other time. "

Overall probably the real 'sticking point' remains this clause:

"Legitimate interest"

"In specific situations, we may require your data to pursue our legitimate interests in a way which might reasonably be expected as part of running our business and which does not materially impact your rights, freedom or interests"

Although I have asked a few to explain this (eg. who decides what is 'reasonable'and/or 'materially impacts', US or YOU ?) but have nor received any answers (so far)...

and which thus probably tells us all we need to know...?