https://ec.europa.eu/info/law/law-topic/data-protection/refo...
The law applies to... 2. a company established outside the EU offering goods/services (paid or for free) or monitoring the behaviour of individuals in the EU.
Do you have any evidence? You're doing business with EU citizens. You allow them to connect to your site.
Wouldn't this operate similarly to how extradition by the US of foreign hackers work?
Of course, if you ignore the EU repeatedly, you’re going to be stuck if you ever want to expand to the EU, or have any assets there ever. That’s about all they can do.
"Whereas the mere accessibility of the controller's, processor's or an intermediary's website in the Union, of an email address or of other contact details, [...], is insufficient to ascertain such intention, [...]" (https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...)
My whole point is, just because the EU makes a law doesn't mean it can enforce it.
> Wouldn't this operate similarly to how extradition by the US of foreign hackers work?
It would not.