Enforcement in practice is almost certain to be "at the edge" with things like payment processors and ad networks that have direct business operations in the EU and are easy to demand third-party compliance from.

If you literally don't do any business with EU entities, even at arm's length, enforcement is going to be impractical and unlikely.

I also believe this. If you run a side project by yourself and you don't target EU users directly, but might have a few, it most likely won't be worth the effort to actually follow through on enforcement.

However, that seems like a very arbitrary line and governments love to waste money.

If you plan on doing business with EU entities at any point in the future there could be risk

Ha. You’re insane if you think that the US Congress is going to start letting 28 agencies in the EU start fining small businesses that have no EU presence whatsoever. The political ads write themselves.

I guess the question is what does the EU value more, privacy or their relationship with the US?

I don't have an answer but I suppose we'll find out soon enough.

I have an answer: no way is the EU going to cut ties with the US over this, and no way is the US going to let the EU trample their national sovereignty by letting regulators start fining small businesses with no US presence because some EU citizen sent their data INTO the US. That’s ludicrous.

yeah.... that's gonna happen