If that US company wants to do business with people or businesses located in the EU GDPR rules absolutely do apply. Yes, providing a free website can qualify a

If that US company wants to do business with people or businesses located in the EU GDPR rules absolutely do apply. Yes, providing a free website can qualify as "doing business", too, for example if the company running the website uses it to attract potential customers, which arguably is one purpose of Hacker News.