The legal line is EU laws, with some considerations (at the time of enacting them) about what other countries and international organizations (like the WTO) reactions.
The practical line is enforcement.
As the country with the biggest stick (not only militarily but economically) the USA provides the best examples:
the ongoing Huawei affair, with one tip executive arrested on the grounds of a Chinese company selling technology to NK.
the Helms-Burton Act that punishes foreign companies trading with Cuba, and that asserts that USA courts can decide on issues of private property in Cuba.
the Iran embargo.
In the Google case, it is even simpler. If Google wants to do business in the EU, it must follow EU law like everyone else (same happens in the USA and elsewhere). The fact that parent company is registered in the USA is not relevant. And probably, the fine has been issued not to the parent company but to the subsidiary registered within the EU.
In the John Doe CASE, France (not the EU) could try first to seize any of his assets in France and, if those are not enough, go to the USA courts and try to have them enforce its judgements. But if what John did was not illegal in the USA then the courts would probably refuse to do so.
That does not mean that John is guaranteed to be immune to any consequences, as France could block international money transfers to John's accounts, force Amazon (or whoever) to make his shop unavailable in France, block his page, and even issue an international warrant that would mean that Jhon would have the risk of being arrested if he ever leaves the USA.