You don't need to bomb anyone.
Add IP rules at cables inside and out of let's say EU and block it there.
Same way we deal with any non-compliance thing. You can't import it.
Your server/domain doesn't satisfy requirments. Either the originator complies or not (e.g. through trusted third party).
No geolocation is needed. And even if it was, these are technical problems, inherently solve able.
So far, we are building walls and replacing mortar with a new one, while attackers bombard us with complete impunity. This is never going to work.
This would of course need new extensions /protocols (even simplest would require authentication envelope around encrypted traffic).
Because ip geolocation has always been reliable and never inaccurate?