Several, but this one explains the issue most succinctly: https://aristilabs.com/how-the-gdpr-apply-to-your-us-based-company-how-the-eu-can-fine-us-companies/

Several, but this one explains the issue most succinctly: https://aristilabs.com/how-the-gdpr-apply-to-your-us-based-company-how-the-eu-can-fine-us-companies/ https://aristilabs.com/how-the-gdpr-apply-to-your-us-based-c... "Under Article 3 of the GDPR, your company is subject to the new law if it processes personal data of an individual residing in the EU when the data is accessed....the GDPR can apply even if no financial transaction occurs. For example, if your organization is a US company with an Internet presence, selling or marketing products over the Web, or even merely offering a marketing survey globally, you may be subject to the GDPR." With regard to enforcement.... "...EU regulators rely on international law to issue fines. Written into GDPR itself is a clause, stating that any action against a company from outside the EU must be issued in accordance with international law." Most US states have adopted the Uniform Foreign Money Judgments Recognition Act (UFMJRA), which allows for judgments issued by foreign courts to be domesticated. Once that is done, the judgment carries the same force and effect as if it were originally issued by a US court.