>
Many other tools are doing nothing nefarious with dataYou're missing the point of the danger then.
Facebook isn't doing anything "nefarious" with the data either. And yet Cambridge Analytica happened.
Fact of the matter is, it's not what you do with the data that counts the most, the biggest problem being that the data gets collected in the first place without users being aware of it, or aware of implications.
How many users do you think are aware that Facebook follows them around the web and that this might affect their credit score, or the price they pay for their health insurance in the future? How many people in a minority, e.g. of a certain religion or of a certain sexual orientation, do you think are aware that their habits can be used to precisely identify their identity and preferences, which could put many such individuals in life threatening situations?
Of course, you might be a responsible company, you might actually do good by your users and customers, but if the users don't expect tracking to be part of the service and if making them aware makes those users to not opt-in, then you are doing something nefarious by definition.
Which is what GDPR is about.