The GDPR doesn't impact a lot of companies, if you are acting on behalf of a customer who is the actual data processor for instance.

It's adorable that you think every company actually abides by these rules. There have been class action lawsuits recently against the largest tech companies. Why wouldn't the smaller ones break the rules too?

It's akin to cheating in financial markets. Hedge funds will gladly commit fraud or other cheating methods as long as the fine is less than the income gained.

Well the article then proves clear violation of those rules. Not only is no consent or notification provided but when the secret data collection is blocked the device gets remotely disabled. Perhaps someone should file a complaint against this company and see if they get fined to death.