This is the crux of the issue to me, they've now made a privacy opt-out that requires you to broadcast an SSID, in order for their systems to ignore your BSSID.

This is the crux of the issue to me, they've now made a privacy opt-out that requires you to broadcast an SSID, in order for their systems to ignore your BSSID. If they don't have an alternative to this opt-out then there's probably a GDPR case right there.