...until someone investigates deep enough and discovers that. Remember that under the GDPR the site has an obligation to tell you who they send the data to and

...until someone investigates deep enough and discovers that. Remember that under the GDPR the site has an obligation to tell you who they send the data to and for which purposes. So they would be breaking the law two-fold, hiding the truth and processing your data non-consensually. That would be a death sentence in court, since it proves malicious intent to bypass the law.