TLDR: it's unrealistic to require a company to follow every country's laws just because some of that country's citizens use a service based outside of that country.

The concept of data being "stored" like it's a card in a library card catalog is an anachronism. The physical location is irrelevant. It's the policies and laws under which the companies must deal that's more important. Of course enforcing certain laws in certain countries is impossible if the company doesn't have a presence in that country. In that case, it's up to the user to decide if they agree to whatever terms of service are offered within the country I which those terms are enforceable through the contract law process. Ultimately if a Google user doesn't like the US law or terms of service offered, it's up to the customer to go to another service. It's unrealistic, not to mention crazy to force an Internet company to follow 170+ different country's laws when those laws are often contradictory. Instead, it might be good for an Internet company to have a statement that outlines what jurisdiction under which they reside in terms of enforcing terms of service agreements. Most have this contract language already, but to make it clear to the user would allow them to make informed choices about the services they use.

The alternative if to wall off the internet by physical geography. So Google.com wouldn't work in France, only Google.fr. That regionalization of the Internet is a horrible idea. You end up with Google.cn if you do that. If you use an American service, it's expected that it follows American law. You, the user, are entering their place of business (virtual or not,) therefore their jurisdiction is the jurisdiction of record. If I travel to the U.S. and buy something at a store, EU consumer protections don't apply, nor should they. If I make a telephone order from a U.S. shop, they don't have to comply with European law; I came to them. That extrapolates to the virtual world as well. However, if a company does have a physical presence in a country, then obviously they are compelled to comply with local law. However that could be argued when it comes to online services -- just because WalMart has distribution centers in China doesn't mean that the WalMart in Nebraska has to follow Chinese law.

Really I would argue for full and transparent disclosures AND I would support an Internet Privacy Treaty that provides reciprocity or equal protection between two countries. So a French Google user has the protections they expect but an American DailyMotion user has the protections they expect and claims could be mediated in either country. I am not a lawyer, nor a huge expert, but I do have some experience with my iCouch company (online therapy.) We have customers from the Middle East who see therapists based in the US, and it's explicit that the customer's interaction will be governed by the locale in which the therapist is located/licensed. It would be a virtual impossibility to have to conform with every country's laws.. We can't realistically stop visitors from certain places; should we be liable? Of course not. The visitor is the one that makes the choice to visit us or not. I am not as articulate about this as I would like, however one can see the maze that this starts to reveal. It's not a simple question of "where is the data stored."