> This is the point when the GDPR kicks in, In the real world, Facebook doesn't trade money, but services, for this data. (Mostly.) And the GDPR applies all th

> This is the point when the GDPR kicks in, In the real world, Facebook doesn't trade money, but services, for this data. (Mostly.) And the GDPR applies all the time. Do companies have a “legitimate interest” to give pseudonymised transaction data to Facebook (pseudonymised using Facebook's answer key), in return for “marketing and business insights”, without the consent of those whose data is being traded? I'm pretty sure that doesn't fall under legitimate interest, and there isn't another GDPR reason that might apply.