GitHub, as any other US company, has a choice/freedom to stop offering services to customers outside the US market, if the particulars of providing those services causes them to violate laws in at least one of the jurisdictions.

Of course, US companies should be rightfully pissed, if the US government puts them in a situation where they can not (legally) operate abroad. But that's something they should take up with US lawmakers.

At the end of they day, they are still (most likely) operating illegally on a foreign market, even if they are unlikely ever to be substantially punished for that. The thing is, the US has a rather questionable track record of coming to the rescue, whenever a US companies get into trouble for (illegally) doing business abroad. Ironically, whenever another country does that (e.g. China) the US immediately have a long list of choice words an allegations at the ready. Long story short: pure hypocrisy.

I don't expect any US entity to "respect" GDPR. Unless they are expecting to trade in the EU. If you trade in the EU, and violate EU law, then you can expect to be fined - wherever you choose to locate your HQ.

Incidentally, GDPR is pretty badly flawed. The intrusive cookie popups are an egregious example of unintended consequences - those popups are actually attacking privacy.

EU wants American companies to follow GDPR when acting in EU market.

I'm not saying that US companies should not enforce US law. I think they should. That is: strictly within the US market.

When they operate outside the US market, they have to (also) adhere to whatever law exists for that market. If that creates a conflict, the company has a choice to either open up show elsewhere, outside of US jurisdiction (if that's the only way to comply with local market rules), or stay in the US and leave the foreign market alone.

Either way, being a US company should never be a valid excuse to violate laws (and/or legal protections) somewhere abroad.

It ultimately is up to a company to choose what they do and where they do it. To me, the current status quo appears to be that many US companies have been (illegally) enforcing US laws outside of US jurisdiction. Aside from that, and maybe even on a far worse level, they have been essentially been making up de facto "private laws", in their TOP/EULA "contracts".

Last time I checked, law should be left to governments. Preferable through democratic due process. Certainly not to commercial companies, who are either privately owned, or publicly by a select few rather undemocratic entities.