This is a student run newspaper. They probably don’t employ a dedicated IT professional nor a legal professional to help them understand what GDPR requires of them. It’s easy to say “compliance with GDPR is so easy” when you’ve taken the time to understand what it requires—why should an American student newspaper have to take the time to learn other countries’ laws? Blocking access is easier especially considering the probability of the web site appealing to an international audience.