@p >It applies to servers located in the EU; people have attempted to claim that FSE is violating the GDPR.
No no no.

GDPR is protecting EU residents rights, regardless of where the fuck the data, servers, admins, … are present, because those simply do not really matter. Incidentally, anything in USA because of garbage like the patriot act, can't guarantee those rights and so are deemed inappropriate, because you cannot ask someone if it's okay to ignore their rights. (How the hell is it supposed to work with stuff like federation and exclusively USA services? I don't know.)
Appropriate countries being on: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en/