I am not sure if they are in violation, if they track but do not use the data. As I understand it, the manage option is the permission to use the tracked data.
Data collection is also part of the regulations; only collecting the data they need. Tracking data they do not even use seems to me to be a clear violation.