>He said the site does not make money. So why would he spend more of his time to make the changes needed to be compliant?
I think you could ask that question about all the other formalities you have to engage in as well if you run a business? Managing his taxes probably takes more time than making that kind of business GDPR compliant
I haven't seen his tax return of course, but perhaps he's not running it as a "business" at all. From the sounds of things it was a side project and could easily be classified as a hobby even if it were generating a little income.
I think you could ask that question about all the other formalities you have to engage in as well if you run a business? Managing his taxes probably takes more time than making that kind of business GDPR compliant