[asaph]

False. GDPR is broad. Anyone running a non-trivial website needs to invest a non-trivial amount of time and energy into ensuring compliance.