> Again, the GDPR applies to EU residents, not citizens.

But what's a "resident"? That means where you live, not where you're temporarily staying.

> A German citizen in the US isn't protected by the GDPR.

If he's just visiting the US he's still a resident of Germany, AFAICS.