What does "doing business" mean here? I've read Recital 23 and at best it is vague and seems up to the discretion of the various member states.

It would be a great service to everyone if the EU could clarify which type of sites do not have to comply. Otherwise, you can hardly blame organizations that it would be cheaper to block EU traffic than even just to pay a lawyer to try to figure out of GDPR is applicable.

It is vague; I believe this is an issue of trying to apply a US law perspective to Europe (common law vs civil law). The main problem with letter of the law interpretations is they go out of date quickly, and there might be significant loop holes - so they didn't do that. Do you think it's possible to come up with a definitive list of "type of sites" that don't have to comply? Might be tricky.

And I definitely don't blame organisations blocking EU traffic; it's at least an honest admission they won't protect your privacy. (Although it may not be a decision of the site itself, I'll get to that in a second.)

Recital 23 is spot on though. Can a New Hampshire-based local news site be said to offer goods or services to members of the Union? It sure sounds like you could say "no" in good faith (which is a defence, IANAL etc).

Can the same be said for either a huge multi-national, or trackers and ad-flinging networks a local site might use? Probably not...

Even for a truly local news org, it might make more sense to just block Europeans then allow them, because Article 3(2) of the GDPR, which gives the EU extraterritorial powers to prosecute.

While it's never been tested, there is a good chance the USA would cooperate with an extraterritorial prosecution, and so it's easier to just avoid it altogether by blocking Europeans.