IP addresses are specifically considered to be personal data, so even accepting a page view from an EU citizen and writing the IP to an Apache log file could su

IP addresses are specifically considered to be personal data, so even accepting a page view from an EU citizen and writing the IP to an Apache log file could subject them to it. Same with cookies and any kind of analytics or advertising partners (which most local news sites seem oddly heavy on). Even if they somehow figured out that they were already completely compliant (and ignoring the work involved in discovering that), there are policies and procedures you need to write to document who you share their data with and respond to requests from EU citizens about their data and the features to support answering those.