According to the eu, if its a search or social media platform, yes.
Discussion
But that would be 'platform (search or social) users', not 'web server users'.
What if there's no user login?
NIP-42 authentication is effectively a login.
Over the long run law does catch up with reality. If half the world uses Nostr, arguments like "it's a web server without login" won't matter. The EU wants to regulate the content of social media, and they will adjust laws to do so.
This typically seems to take a decade, or two.
What ultimately matters is not the legal details but:
1. To what extend censorship (and other regulatory burdens) are simply not practically enforceable.
2. To convince lawmakers that there's really no need to regulate this. (lol)