How can Australia exert legal authority over a company that has no legal presence in the country and one Australian user?

I'm not informed on the subject, but narrow-mindedly, GDPR and serving EU customers?

Yeah, that has exactly the same problem with respect to jurisdiction.

The only difference is that it's easier to write off Australia than the entire EU.

> 1.

A company based in Iceland might have Australian customers, but if they have no representation in Australia, there's precious little the authorities can do. They are of course free to pursue their inquiries through the country where the company is resident (Iceland), but that country has no obligation to adhere to Assie laws, and most likely isn't going to.

> 1. The law applies to all tech companies who have users in Australia, regardless of where the company is incorporated.

Yes, but as someone not living in, working in, or traveling to Australia I don't really have to care. I don't own a company that makes crypto, but if I did, my reaction to this would be along the lines of "don't open a Sydney office but otherwise business as usual".

Also you can't employ any Australians, because they are all covert government spies now.