Without long-arm statutes, GDPR is worth less than the paper it's printed on.
This is "most disappointing", to put it politely
Privacy advocates at Noyb filed a criminal complaint against Clearview AI for scraping social media users' faces without consent to train its AI algorithms. Austria-based Noyb (None of Your Business) is targeting the US company and its executives, arguing that if successful, individuals who authorized the data collection could …
In fact the State Department pretty much always says no - notwithstanding any extradition treaties the US pretty much adopts as default the position of "we will never send a US Citizen abroad to be tried for any reason, anywhere". They can make whatever treaties they like saying "we'll extradite them this time, promise!" but then they never do. Ever.
So you either have to try them in US courts following US law (which may or may not recognise jurisdiction) or hope to arrest them outside the USA on some domestic or international arrest warrant and either try them under your own system or have them extradited to your country by the third party country that arrested them.
The most likely outcome however is that they never travel outside the US and are thus immune to the warrants or prosecutions etc.
The online safety act has led to an overreach of all these new companies wanting to take our ID, or likeness, as part of their business model. It's yet another piece of data that's out there, which is at risk of being stollen and used fraudulently.
If it was really about safety, the government would have mandated the verification methods which could have included not having to give copies of your ID or likeness over the Internet.