For U.S. companies that have a physical presence in the EU, the GDPR can be enforced directly. For the other cases, EU uses intentional law. EU-U.S. Privacy S

For U.S. companies that have a physical presence in the EU, the GDPR can be enforced directly. For the other cases, EU uses intentional law. EU-U.S. Privacy Shield data sharing agreement for example. In the case that the law can't be enforced directly against the violating company, EU can enforce it trough companies that provide the infrastructure for handling user data and have dealing with EU. This includes trackers, online ad-selling companies, clouds providers, CDN provides, ISP's that have physical presence in EU and who handle user data when people visit the site. Like Google, FB, Amazon, cloufare, Akamai, Rackspace, Digital Ocean, ...... Also, if the company takes any money from the user from EU, they can get into trouble when banks with business in EU stop transferring payments. Only if the company is handling all user data using companies with no EU presence and are not violating any US-EU privacy agreements, they should be safe.