If the developer is in the EU, they can come after them. If not, the EU can direct Google to revoke the verification. The commission has a big lever to pull with fines which are pretty much arbitrary.