Ugh.

Isn't this illegal under GDPR?

Definitely hoping all the fines (thinking of the $1.4T lawsuit also in the news) add up to more than the company is worth.

Not until they get fined pennies on the dollar in a few years and then spend more time in court fighting it until they are actually required to pay said fine, at which point it doesn't matter anyway.