In this case it would be the US courts. In Britain it would be the ICO who despite claims from companies like hiQ to be GDPR "compliant" they clearly aren't.