they don't need to retrofit their entire website.

Except they do, because even if they’re pretty certain their site is compliant with GDPR they’d still have to review the code to make certain it is or risk legal liability if anything isn’t.

Many small to medium organizations that aren’t operating outside of the USA chose to just block connections instead.

Is there a lot of people outside the US checking an “affiliate for the Duluth-Superior broadcast area, which covers northeastern Minnesota, northwestern Wisconsin, and the western portion of Michigan’s Upper Peninsula” regularly for their news?