I think this shows limit of GDPR which maybe could be improved by making companies your data is shared with, seek authorization to treat those data directly, ma

I think this shows limit of GDPR which maybe could be improved by making companies your data is shared with, seek authorization to treat those data directly, maybe let's say you sign up on $ocial network which share your data with mark€ting company, then maybe mark€ting has to send you an email to be authorized? So that Truecalled can get numbers from contacts list, but can't use them if not authorized?