My understanding of the GDPR (did a course on it for work) is that it allows data sharing for advertising to named companies, but holds you and the advertiser r

My understanding of the GDPR (did a course on it for work) is that it allows data sharing for advertising to named companies, but holds you and the advertiser responsible for ensuring that no-one else gets your data without permission and for letting you know if any such data breach occurs. But I agree with you on the principle that bureaucracy very seldom does only the things I want.