Or, I should say, things are enforced after the fact, through the possibility of criminal charges or civil lawsuits. Enforcement doesn't mean that crime is made impossible, just that there is enough deterrent.
Its not. Especially when using US Cloud services. And people do that. Hell even government run schools us GDRP-violating software and force the students to BUY them. The law is nice, the reality is different...