Yes they are as long as it's clear you are agreeing to something, which is why pop-up EULA's have an I agree button and obligate you to scroll to the bottom.

GDPR does not make collecting aggregate data unlawful, so unless you can prove that the data collection is identifiable then GDPR doesn't apply.