It's not that guaranteed.

The reality is that if you have any interest, company or employees in the US you can be coerced to do anything the US government wants.

Either legally through courts, or through business influence, or through harassment (e.g. hardcore checks from the IRS).

Sorry, Stripe rejects you now because you are high-risk (you have to explain why you refuse to help in criminal cases, though there is a court requesting you).

You don't like to comply to US requests and protect terrorists ?

https://support.stripe.com/questions/how-to-resolve-blocks-o...

Still don't comply ?

You are added to sanctions list, end of the game.

https://home.treasury.gov/news/press-releases/sb0185

Even Microsoft acknowledges that these cross-border requests cannot be avoided.

https://www.convotis.com/es/en/news/microsoft-access-eu-data

The same way that EU can force fetching data from the US entity.

Now on the EU side:

GDPR fine of 4% of your worldwide income. Well, too bad, your US entity refused, we will have to punish your EU entity very strongly.

If small provider, oh right you refuse ? Well, we will notify your bank that you do not respect the court orders, etc.

The law is one of the way of enforcement, but there are multiple stages of pressure.

Still refuse ? Well, let's come to you at 6am then.

https://www.insurancejournal.com/news/national/2020/07/10/57...