If something like it were to provide free service over the Internet, not sell ads or whatnot in the US, it doesn’t fall under US jurisdiction.

Actually, that’s a point where there is precedent to the contrary. The GDPR claims extraterritoriality even if there is no payments involved, if the free services are provided to EU citizens. It enforces it by proxy, mostly through international agreements, like in the case of US companies.