Probably nothing happens. I doubt they're going to spend time investigating a company that doesn't do any business in Europe, when there's a very long list of bigger companies that do operate here and break our privacy and sell our data.
if a EU user is in the US ON HOLIDAY! and they're using your service, you're subject to the GDPR
(in theory)
A bit more unclear situation is if non-resident is visiting EU and uses services from their home country.
given "within the Union" is used separately in the next sub-article to mean physically located within, it's arguable that "in the Union" could mean citizen of