This is not entirely correct, GDPR does not necessarily require consent, see https://en.wikipedia.org/wiki/General_Data_Protection_Regulation#II_Principles http

This is not entirely correct, GDPR does not necessarily require consent, see https://en.wikipedia.org/wiki/General_Data_Protection_Regulation#II_Principles https://en.wikipedia.org/wiki/General_Data_Protection_Regula... However, you are right in saying that this violates the GDPR, because the data was collected for a different purpose, and using it for another reason like advertising is not allowed.