GDPR fines companies that operate in the EU. If you don't operate in the EU, you don't have to comply. The only penalty possible in that case is that your operations that are in the EU will be fined. You won't be deported, and also it applies to corporations, not individuals.

I think the analogy is still apt for having laws that charge someone outside of one's geographic region or citizenship. I do agree with you that the analogy does not go much further than that, as GDPR is not for individuals, does not have incarceration as a punishment, and does not have extradition to seek that punishment.

I guess my analogy was specifically targeting whether one government could have a law governing someone's behavior outside of that region, because I was responding to the assumption that he hasn't done anything wrong, and I think in regard to the current laws of the US government, he may have.