Even if GDPR was merely touching the internet, it is touching the internet, which is my point - people said things like "the people in EU know what they're doing", why isn't it true now?
But it applies to processing of personal data, this is independent of if it happens over the internet or not.