Yes, almost certainly so. You did not consent, they have no legitimate interest to track you, and you were never informed about the what and why in plain language.

The GDPR isn’t the complex legislation monster people make it out to be, but for the most part common sense about handling sensitive data.