There are ways. How about: arrest ClearView top brass on their next visit to Europe? Remember the Huawei heir who got sent to jail on a trip to Canada. Do the ClearView head honchos really want to be confined to travelling within the US? So while it might be difficult to go after ClearView in the US, France (and the rest of the EU, the UK, Canada, Australia) would become no-go zones for ClearView staff. Not to mention that these countries could also seize assets owned by ClearView leadership, as long as these are within their jurisdiction. In an interconnected world, it is exceedingly difficult to avoid such scenario.

The question is rather: would the US step up and put pressure on the French if events would unfold in this way?

If the company doesn't do business in the EU (i.e. has no EU customers), there are still some things that can be done. Maybe target suppliers to Clearview? The cloud providers are obvious targets. Put out arrest orders for Clearview employees? Maybe try to have the US govt enforce it?

GDPR

How does GDPR allow a foreign entity to punish or fine a company based entirely in the USA? I am genuinely curious, I have wondered this for ages. Every resource I have looked at says that as a US business I need to comply with GDPR, and that I can face fines if I don't. But I have never seen the mechanisms in which those fines can be enforced. Is the US government enforcing those fines?

If you do business in the EU, you likely have money there. Might be hard for a company that isn’t international to be fined though. However, California has privacy laws now and could fine a US company.