Tracking you and storing the data without good reason and without up-front transparency is very clearly a GDPR breach.

When will these idiots learn that you simply cannot go gathering personal data on the off chance you might find it useful or sell it. Gathering unnecessary personal data isn't an asset, it is a liability. And so it should be.

https://ico.org.uk/for-organisations/guide-to-data-protectio...