amusingly enough, coming from the EU the site told me: "451: Unavailable due to legal reasons"
It's legitimate in the same way that '451: we want to load up our site with so much javascript your computer catches fire and burns your house down, but that's illegal in your jurisdiction so this site is Unavailable for Legal Reasons' is.
To me 451 is like 404 (nothing here) and 410 (was something here but now there isn't) - it's a further progression/specificity to 'was/sort of is something here but it's not presently available for legal reasons'.
Common obvious one is DMCA takedown notices, but it might also be an injunction, or even accidentally published while still under embargo - or deliberately to prime SEO (not advice) - or NDA, etc.
Project Guttenberg in Germany (and The Pirate Bay in the USA, I think) would be 451.
It’s not something to be proud of, but it is something I am sympathetic about. Modern laws (not just GDPR) are long and the language is often hard to understand.
I believe that laws must be simple enough to comprehend, or else they will not be comprehended and thus will be violated even by people who want to follow them — the phrase would be better if it was “ignorance of the law cannot be an excuse”, because that works both ways.
It's an approximate and somewhat mythical value, popularised by Ray Bradbury's novel. Actual ignition point varies bu 100+ °F. Experience this past year with sourdough baking --- on parchment paper at 290°C (550°F) --- shows that though the paper browns, it does not combust. (Possibly affected by thermal mass / moisture of bread loaf.)
https://slate.com/technology/2012/06/ray-bradbury-death-does...
</pedant>
[1] https://en.wikipedia.org/wiki/Fahrenheit_451_(disambiguation...
In practice, you need a consultant and maybe a lawyer to help with the paperwork and that's assuming all the processes are basically in compliance.
If you are not in Europe, the main thing that determines whether or not GDPR applies to your site is Article 3 of the GDPR, "Territorial Scope", and the corresponding Recitals.
A big factor there is whether you are offering goods or services in the Union, irrespective of whether or not users have to pay. Mere accessibility from the Union isn't enough to show you are offering things in the Union. What matters is whether or not the site "envisages offering services to data subjects in one or more Member States in the Union".
There are several things that can show you are envisaging offering in the Union. Having localized versions of your site in languages that are used in the Union but not in your own country, accepting payment in Euros or the national currencies of Union members, targeting Europeans with ads for your site, and many others.
If you aren't doing those things, it gets more subjective. If your site should be of no interest to Europeans, and you don't expect to make any money from whatever Europeans happen to somehow end up on it, it is simplest to do a geoip block on Europe. That should conclusively establish that you do not envisage offering services to people in the Union.
In practice, if you don't have high visibility (i.e are small enough, which probably means 90% of websites) and don't have any presence in the EU then just ignore GDPR because no-one is going to go after a website on another continent because it tracks visitors and sometimes people from the EU visit it.
however, a lot of "small", local news organisations are actually owned by huge (multi-national) corporations. they might work hard to preserve that small appearance, but do have a reason to fear the GDPR.
Because as you said yourself, they're part of a large organization that DOES do business with Europe, but that part of the business doesn't get any money from Europe, so there is no reason for that part of the business to go to the effort of complying.
you said "local news organizations", and i was simply pointing out if that is what they truly were, they wouldn't have to comply. so i think we agree?
While it's never been tested, there is a good chance the USA would cooperate with an extraterritorial prosecution, and so it's easier to just avoid it altogether by blocking Europeans.
It would be a great service to everyone if the EU could clarify which type of sites do not have to comply. Otherwise, you can hardly blame organizations that it would be cheaper to block EU traffic than even just to pay a lawyer to try to figure out of GDPR is applicable.
And I definitely don't blame organisations blocking EU traffic; it's at least an honest admission they won't protect your privacy. (Although it may not be a decision of the site itself, I'll get to that in a second.)
Recital 23 is spot on though. Can a New Hampshire-based local news site be said to offer goods or services to members of the Union? It sure sounds like you could say "no" in good faith (which is a defence, IANAL etc).
Can the same be said for either a huge multi-national, or trackers and ad-flinging networks a local site might use? Probably not...