IANAL.
I don’t think gdpr is required when it’s not a company running the instances?
Depends on whether your thing is intended for public or private use. If it’s just a static website to share files with friends and family or a chat service for a similarly limited group, then no, the GDPR does not apply.
Most popular Fediverse instances are clearly made for public use however.
if an instance is hosted in America, does it still apply
As long as it processes data of EU citizens, the GDPR applies. Whether the EU is able to enforce it is a different question.
Removed by mod