As a note - this is only one interpretation of the situation. In my opinion, if the privacy policy of a website is clear, then using their service and having one's collected data used as stated is not infringing on anyone's rights.
GDPR doesn't stop you from creating a service that's a massive invasion of privacy, but you've got to ask permission first in plain language and allow people to change their minds later. If it turns out that users aren't willing to give that permission and revoke permissions that they have previously granted, it vindicates one of the basic arguments for GDPR - users wanted privacy, but they weren't being offered the opportunity to make a free and informed decision.