If you're a US company and some of your users happen to be European, and you just ignore this and store all users' data in the US, what kinds of sanctions can b

If you're a US company and some of your users happen to be European, and you just ignore this and store all users' data in the US, what kinds of sanctions can be imposed by the European Court of Justice or national authorities in individual European countries? Do they have some way to block your site at the national / continental level or go after your users? Can they fine you, send you a bill and ask US authorities to seize your company's assets if you fail to comply, even though you're breaking no US laws? If they can't take any enforcement action against non-compliant companies outside European borders, how does this decision even matter for non-European startups?