How does GDPR allow a foreign entity to punish or fine a company based entirely in the USA? I am genuinely curious, I have wondered this for ages. Every resource I have looked at says that as a US business I need to comply with GDPR, and that I can face fines if I don't. But I have never seen the mechanisms in which those fines can be enforced. Is the US government enforcing those fines?

If you do business in the EU, you likely have money there. Might be hard for a company that isn’t international to be fined though. However, California has privacy laws now and could fine a US company.