I've seen a lot of privacy policies include lines like "we collect your activity data on the website, so we can improve your experience" or "we use cookies to g

I've seen a lot of privacy policies include lines like "we collect your activity data on the website, so we can improve your experience" or "we use cookies to gauge how to improve our services" or "we collect usage data to improve our marketing across other sites and platforms", which are both horribly vague and certainly not vital to run the service. I took those lines basically verbatim (translated from Danish) from Just-Eat's Danish website. I am pretty sure they're violating GDPR, based on what they say in their privacy policy. Collecting usage data and sending data to third-party marketing companies is not vital to running a food ordering website. A ToS is not a legally binding contract, and I have not been asked for direct consent to their use of my data.