> Their absolute best option would be to attack global platforms that small businesses rely on to get the platforms to enforce compliance or blacklist those sma

> Their absolute best option would be to attack global platforms that small businesses rely on to get the platforms to enforce compliance or blacklist those small companies. This is especially potent for Visa and MasterCard. I doubt that will ultimately work though. Actually, that part is the most plausible way that companies outside the EU with no EU presence could be forced to to comply the the GDPR.