Yes, American companies could be subject to EU General Data Protection Regulation (GDPR). USA-based companies must comply with the regulation in case they sell goods or services to people within the European Union, monitor their behavior, or process personal data as a part of activities of their establishment in the EU.