Most regulators do not charge teenagers in their bedrooms except for the most egregious criminal acts. If you are a teenager operating a website from your bedroom, you functionally do not need to worry about ADA, GDPR, etc.
ADA is enforced (abusively) by private claims, not regulators, at least in CA.
It's totally possible for a bedroom-made startup to grow to the point where the lack of GDPR enforcement could be directly harmful to customers, for example. True it's unlike they'd get noticed, but I don't think that's a strong argument here.
I want reasonable widespread application of GDPR, ADA, etc with explicitly carved out safeguards for small operations like this teenager.
They shouldn't have to rely on getting lucky