IDK what the situation was like specifically two years ago, but now:
They have a whole section in their privacy policy on GDPR and CCPA etc, as well at clear instructions on how to use their service 100% anonymously leveraging TOR and Privacy Pass (+bitcoin and a burner email if you don't want people even knowing you have a Kagi account)
https://kagi.com/privacy/rights
Seems weird to put in a whole Privacy Rights section about the privacy laws that apply to them if they don't think privacy laws apply to them.