GDPR rules do not apply to YC - a US company.
> Article 3 of the GDPR says that if you collect personal data or behavioral information from someone in an EU country, your company is subject to the requirements of the GDPR. Two points of clarification. First, the law only applies if the data subjects, as the GDPR refers to consumers, are in the EU when the data is collected. This makes sense: EU laws apply in the EU. For EU citizens outside the EU when the data is collected, the GDPR would not apply.
It's more complicated than that though. Just Google and you will find some valuable information. https://www.forbes.com/sites/forbestechcouncil/2017/12/04/ye...
Yes, providing a free website can qualify as "doing business", too, for example if the company running the website uses it to attract potential customers, which arguably is one purpose of Hacker News.
I'm not a lawyer, but it's fairly obvious that web services built in accordance with the jurisdiction of incorporation take precedence, especially when the software/service makes no customization to appeal to the EU. Maybe one runs a blog with content critical of China, but since they're running said blog as a US corp on US soil, China cannot apply it's laws on the said blog.