EDIT - just to be clear, I'm talking about emacsclient, talking to a emacs server. Not an actual full blown emacs implementation that's just stupid.
Old-school pure HTML forms actually has a lot conceptually in common with block mode terminals such as IBM 3270. The server sends the client a fill-in-form, the user fills it in, the client sends it back to the server in one block. Most of the logic exists on the server (although some basic very basic validations may execute on the client). So, I was actually talking about serving up a classic pure HTML form app over HTTP as a UI style.
I'm just talking about a thin client, such as you typically use when you have emacs running as a server. You only have to manage text and windowing, and capturing user commands and communicating with the back end. These are the kind of things browsers are good at.
Of course, Emacs doesn't support 3270. But that was my point – that there are UI styles which Emacs doesn't support. They might not be useful UI styles, especially in 2020. But historically they were important, and any suggestion that Emacs is some kind of magic which supports all UI styles isn't really true, although maybe it supports all contemporarily practically relevant UI styles.
It works pretty well.
Let's just hope they don't have annoying GDPR and other popups when you're trying to edit a file.
Your remark about GDPR is kind of strange ... not sure what that would have to do with anything ... GDPR applies to people and organisations, not their tools.
OP is saying that Emacs-as-website would be frustrating if it had those popups.
The cookies warning is all about notifying the casual reader who might otherwise believe they were passively browsing static content.
Logging in means you get a single cookie (a login/session cookie), that cookie is necessary and thus a functional cookie that you can't say no to. All other cookies (and basically every form of tracking) still isn't allowed without consent.
To a lesser extent, there are people that are concerned about "all the extra work" this entails, and the cost it adds to their bottom line. But this stuff is important nowadays. You really should be taking care of it.
There is some scaremongering about small firms being blown out of the water for noncompliance, but really, unless you're doing something you shouldn't be doing you should be fine. The terms of GDPR though still not completely clearly specified are flexible and reasonable. The main thing is now, that you can't say you weren't aware of it.
You know that GDPR doesn't require pop ups unless the service is doing something that isn't otherwise lawful?