When you put together that simple bulletpoint approach you still leveraged baselevel knowledge about the GDPR that would be ridiculous to assume of a CS major.

I miss the web of the 90s too. User expectations and web economy have changed a lot since then though.

> is basically the default way of setting up a website

It's not the default way of setting up an online content management system to which student journalists can post articles without going through some convoluted command-line build process ("...then you do a git commit and push, run the Hugo script, and rsync the files to the server"... yeah, no.)

> It's not hard to check whether this is how your website works.

Since they're using a third-party content management system, they most likely neither know nor even care how the website works. Why should they? They're journalists, not system administrators.

As others have noted, this is an independent student newspaper. Their normal readership outside the Purdue community is probably in the low single digits on a percentage basis, and their EU readership is likely close to non-existent. They (or, more likely, the people who run the CMS for them) have concluded that a full audit of their system to ensure GPDR compliance is simply not worth it for the minuscule number of additional readers they'd gain. And they're almost certainly right.