Yes, but also, it is sad you can automatically safely assume a news site that we only want to display our news will be handling a fuck-ton of our personal information. If it just showed the news and non-targeted ads, it wouldn’t need a retrofit. GDPR wouldn’t apply.