Every US company that processes EU citizen data has to follow strict guidelines and/or get certified to be able to process private info outside of Europe. It's been this way for years and Facebook got decertified because of all their violations and then threw a tantrum threatening to pull out, thinking they had weight.