And, in this case, a local newspaper in a relatively small market. Their exposure is probably pretty limited but it's not hard to imagine a legal or compliance person asked IT is they were compliant with GPDR and the answer came back "dunno." At which point, the decision is between spend an hour to cut off EU access, decide to deliberately sweep any potential problem under the rug, or spend a fair bit of effort to do at least a compliance audit. #1 doesn't seem like a bad choice in this situation.