surely the smart thing to do would have been just to roll the whole thing out without selling anyone's data at all, then implement GDPR-compliant monetisation p

surely the smart thing to do would have been just to roll the whole thing out without selling anyone's data at all, then implement GDPR-compliant monetisation post hoc?