THe problem is what "doing business" means (and what it should mean) for internet companies.
If you're an American company selling your stuff to German users, are you doing business in Germany? What if you don't have a German translation of your site, don't accept Germany-specific payment methods and don't advertise in Germany-specific channels, but still ship there? What if your products are delivered electronically, and you don't apply any IP blocks? What if you IP block Germany, but don't block VPN use? What if you do block VPN use, but still process personal data of German citizens (even without giving them access to your systems)? What if you do everything in your power to stop German users from using your site, but the site is free and VPN detection isn't 100% reliable, so some users do slip through?
Just to be clear, there are no good answers here, and the law (and international law in particular) is wholly unprepared for the realities of the internet.
If you're an American company selling your stuff to German users, are you doing business in Germany? What if you don't have a German translation of your site, don't accept Germany-specific payment methods and don't advertise in Germany-specific channels, but still ship there? What if your products are delivered electronically, and you don't apply any IP blocks? What if you IP block Germany, but don't block VPN use? What if you do block VPN use, but still process personal data of German citizens (even without giving them access to your systems)? What if you do everything in your power to stop German users from using your site, but the site is free and VPN detection isn't 100% reliable, so some users do slip through?
Just to be clear, there are no good answers here, and the law (and international law in particular) is wholly unprepared for the realities of the internet.