American tax laws (like the FACTA) do apply to Americans in Europe, for example. A sovereign entity has jurisdiction over anything it wants. The question is whether it can enforce it, but there are many tools for that, from simple treaties to sanctions to full-blown military invasions.

In any case, parent is in fact incorrect since the GDPR claims no such jurisdiction. It only applies to people in the EU, or to people whose personal data is processed by EU companies.