"So the cost of proving you need the data--who pays for that?"
Most of said cost is very small, i.e. several simple forms (including links to the particular laws that define what data must be kept) and little to no human supervision. If the American (or Whereverian :^) company only keeps the data they need to comply with their legal obligations and only for the mandatory period, everything can be automated in a few hours, and it's a one time charge (unless the laws change).
Things get complicated, though, if they try to keep any other kind of data, or if they expect to sell space in their webpages to the usual suspects (G, FB, etc.)
To make my point clear: I understand that for pop & mom shops with minuscule online sales to the EU, the most cost effective solution could be geoblocking, but for anything above that (i.e. most companies that sell online to the rest of the world) the cost should be peanuts.