Most small web sites don’t have the resources for this. Many don’t even know if they will have analytics in the beginning, or info sec.

People tend to set up sites and just stash web logs in the beginning. They then learn later what their business needs are and may decide to post process their logs.

You're suggesting a new site pay all of these costs up front to comply with these regulations, you can’t time shift concerns by collecting data and deciding whether you need it later.

Granted, you could argue that this is bad practice anyway, but many startups work exactly like this, maximum logging early, dropping rention later after beta.

If you are not physically hosting in the EU, how many people want to even read the GDPR? A lot of sites don’t even know where their users are coming from until they run analytics.