This is exactly why I moved my personal web site from the US to Germany and not to Iceland (which was my original plan). The thing of it was that GDPR provided better protection than no GDPR, and the cables negate any other benefit anyway. But this of course pre-dated the CLOUD act which could land you in jail for complying with either it or GDPR, as one requires you to share when asked, while the other prohibits it. Data protection needs a lot more work, and some precedents must be set for enforcing US law in Europe, and of course vice versa. Happily my server holds only my own data.
