First of, law exists (i.e. "means anything") only if you have the means to enforce it, like armed squads to terrorize the population or a leverage of some other kind. Like, for example, Amazon (wherever it's located) probably has to abide to GDPR as long as it wants to sell to EU customers. Orlando city, located in the US under US jurisdiction, and not trying to sell anything to anybody in the EU doesn't give a fuck about European laws, even if they stated that Orlando should.
Second, it seems to be a popular misunderstanding, that GDPR affects Europeans everywhere they go and you need person's confirmation to store his data. It affects people currently located in Europe, and there are listed multiple very vague excuses for storing user's data without explicit consent, like "in order to protect the vital interests of the data subject or of another natural person", with which global tracking by law enforcement agencies could be easily justified.
Second, it seems to be a popular misunderstanding, that GDPR affects Europeans everywhere they go and you need person's confirmation to store his data. It affects people currently located in Europe, and there are listed multiple very vague excuses for storing user's data without explicit consent, like "in order to protect the vital interests of the data subject or of another natural person", with which global tracking by law enforcement agencies could be easily justified.