So all those US sites are just ignorant? They didn’t have lawyers actually advising them? They just unilaterally shut off access to millions of people out of an abundance of caution? “Unfounded panic” isn’t a business strategy and any non-trivial business is going to operate from legal advice. Obviously, the risk is real enough: the threat of 5% of global earnings is a pretty big incentive to be extremely cautious when dealing with an EU that has a huge financial incentive to go after large American companies.

I wouldn’t run my business with the “hope” that regulators are benevolent. If the media publishes a story critical of a country’s government, what’s to stop them from using GDPR as the basis for a very expensive witchhunt? Even if you have done everything correctly, there is still a significant compliance risk.

It isn’t the compliance itself that is problematic — it’s the compliance risk you subject yourself to when serving Europe. Given most news organizations are hanging by a thread financially, one bit of back luck from an aggressive regulator could destroy the business.

It’s the same reason many European banks have refused to service American customers: the FATCA compliance risk.