It doesn’t mean they “have to abide by GDPR” or that they “are GDPR compliant”. All it means is they appear to be GDPR compliant and pretend to respect user privacy. The sole fact that the AI chatbots are run in US-based data centres is against GDPR. The EU has had many different personal data transfer agreements with the US, all of which were canceled shortly after signing due to US corporations breaking them repeatedly (Facebook usually being the main culprit).
The fundamental roadblock here is: people are generally done with ‘learning’ when they become adult. Not learning computers or software, or anything else in particular. Just learning. There seems to be a somewhat common idea that ‘education’ and ‘learning’ is for children, and as an adult, you should have better things to do. Sadly, we can see all around where such an idea leads us.