Just to correct you, most of what your complaint is about does not violate GDPR. It's perfectly fine to set cookies under GDPR for technical reasons (e.g. sessi

Just to correct you, most of what your complaint is about does not violate GDPR. It's perfectly fine to set cookies under GDPR for technical reasons (e.g. sessions), it's also perfectly fine for them to use a 3rd party to deliver functionality. They can pass data to third parties for processing (delivering a chat app I assume). In this particular case nextdns would be the data controller and intercom their data processor. That is not in violation of GDPR and is something covered by it. I certainly don't think you deserve any sort of 'bug bounty' for this. At best you might have a case of emailing the nextdns information officer and asking them if intercom is selling your email address as intercom seem to claim they do. However, Intercom seem to be very wrong about what they claim as their rights. But at the moment not a lot seems to being done about it for much worse violators so don't hold your breath that will change. In the UK our version of the EFF (ORG) are trying to raise funds to force the ICO to prosecute big adtech that are in much more egregious breach of the GDPR. https://action.openrightsgroup.org/help-us-protect-your-data-illegal-ads https://action.openrightsgroup.org/help-us-protect-your-data...