Came here to say that. I wasn't covered by GDPR under spez's site - but luckily their policies treated me like I was anyways.
I moved to kbin.social - which was probably the 2nd largest after lemmy.world. Also, it was Polish.
What I liked about that was - as per my understanding - since these are hosted in the EU, the GDPR applies to my data here even if I'm not the EU myself and am not an EU citizen.
Why did you think lemmy.world was US based? It's fully European.
But that's probably it - folks assume the instance that's for the whole world is the US-based one and don't feel the need to make another major US-based one.