You can’t just round up some CS students and have them produce a website compliant with international law for free.
This involves legal teams, contracted developers, and constrained budgets that are already stretched thin on operating in their core business. It’s not reasonable to demand they invest tens of thousands of dollars (or demand equivalent free labor from CS students and lawyers) to serve a population that almost never visits the site.
But the issue isn't "international law" in the general case (which, indeed, would be very hard), it's the specific case of the GDPR, the solution to which (for this particular site, which only serves static content) is mind-numbingly trivial: don't collect personal data, don't set cookies. That's it. That's all you have to do.
Though I'm not sure if a local US newspaper even needs to be compliant, since it doesn't target EU residents and thus might be out of scope.
• A static site without JavaScript;
• with all images / external resources hosted on the same domain;
• where the logs are default configuration, don't leave the server (except as GoAccess reports), and are deleted / anonymised eventually;
is GDPR-compliant. Sure, there are other ways to be compliant, but this works, and is basically the default way of setting up a website. It's not hard to check whether this is how your website works.
You can get this knowledge with just the first 7 articles.
It's not the default way of setting up an online content management system to which student journalists can post articles without going through some convoluted command-line build process ("...then you do a git commit and push, run the Hugo script, and rsync the files to the server"... yeah, no.)
> It's not hard to check whether this is how your website works.
Since they're using a third-party content management system, they most likely neither know nor even care how the website works. Why should they? They're journalists, not system administrators.
As others have noted, this is an independent student newspaper. Their normal readership outside the Purdue community is probably in the low single digits on a percentage basis, and their EU readership is likely close to non-existent. They (or, more likely, the people who run the CMS for them) have concluded that a full audit of their system to ensure GPDR compliance is simply not worth it for the minuscule number of additional readers they'd gain. And they're almost certainly right.
I collaborated with some EE and ME students on personal projects, but they were 1) more interesting than GDPR and 2) friends.