Hacker News Reader

For example by not providing a privacy policy that contains all the information required by GDPR article 14.

Wouldn't that be only applicable if they were harvesting people's information submitted by other people?

My first thought is that people running Mastodon wouldn't qualify as data controllers, but I am no expert in GDPR laws.