"We might, maybe, have some article go viral some day. With unknown revenue implications." is a weak argument for trying to figure out and maintain GDPR compliance, which costs real money right now, today. And you have to be sure to maintain that compliance as the web site evolves.

It's such a low-probability event that I don't blame them for just saying, "Nah. Not gonna hassle with that."

The recognition argument is also quite weak--it's not like recognition pays the bills.