If you're a small or medium sized non-tech publisher who outsourced the building of your digital publishing system 5 years ago and have been cruising along ever since, you might not be very motivated to spend real cash on a big new IT project to ensure your various server logs don't have IP addresses or other "personally identifying information" in them, just to name an example.

And, in this case, a local newspaper in a relatively small market. Their exposure is probably pretty limited but it's not hard to imagine a legal or compliance person asked IT is they were compliant with GPDR and the answer came back "dunno." At which point, the decision is between spend an hour to cut off EU access, decide to deliberately sweep any potential problem under the rug, or spend a fair bit of effort to do at least a compliance audit. #1 doesn't seem like a bad choice in this situation.

That's probably the issue. The news site itself doesn't have to do much.

But the ad code and trackers and beacons and all the other stuff that they have installed on each and every page - the news site has no idea what it's doing and how to even begin ensuring compliance.

They don't want to risk 4% fo global revenue to find out.

That's actually the worry. What are they doing with your data that they don't to be transparent about?

They don't know and don't feel like being in compliance with it. Laws like GDPR and specific sales tax laws net these kinds of results all the time in local businesses who don't gain anything by complying.

Just to answer that question can take more time from engineers and lawyers than it's worth for a small userbase.