They are also held to account under GDPR.

Any site that does not explicitly block European users has to comply with it in case they have some European users.