Earlier quoted context omitted.
You don't need to live in the EU/EEA to invoke GDPR rights. Case in point: the UK authority upheld a US resident's GDPR claim against Cambridge Analytica (and yes, Facebook was involved). https://ico.org.uk/about-the-ico/news-and-events/news-and-bl...
What do you mean “upheld”? The story in your link describes the company refusing to comply and then ends. It’s true that you don’t have to be currently living in the EU to invoke your GDPR rights if you’re an EU citizen traveling abroad, or if you’re a foreign citizen traveling or residing in the EU. GDPR applies to companies that market to people in the EU or do business in the EU. BUT - GDPR is an EU law, it does n…
The EU and UK GDPRs can also apply to companies in the US, or elsewhere. That's because location of the business (including subsidiaries) OR location of the individuals, are hooks under the GDPR's territoriality tests in Article 3. You usually need one or the other though; the way GDPR Article 3 works, it's pretty hard to imagine it applying to a US-only business in respect of US resident-individuals.