Considering this is tracking, processing, and transmitting data, and algorithmically making decisions about users, why doesn't this show up in their privacy pol

Considering this is tracking, processing, and transmitting data, and algorithmically making decisions about users, why doesn't this show up in their privacy policy, nor in their GDPR exports? Sounds like a very expensive lawsuit waiting to happen (GDPR allows fining up to 4% of global revenue, not profits)