Setting up all the random shit gdpr requires (downloading and deleting data, protection officer blah blah blah) takes a lot more than a cookie bar. It's expensive and if the site doesn't make much money from europe, why the hell would it waste money on doing that?