They're allowed because the customer agrees, right there in the privacy policy. I think this sucks however, because
1. You get hundreds of pages of contract to read about the phone and the service and billing and everything else. Who is going to spend a week doing a doc review to buy a phone?
2. It's opt out. GDPR got this right. Even if you do opt out, how do you know if they handle your PI correctly anyway? They get paid to abuse it and penalized to respect it.
3. And the big one is: there's no alternatives. IF all the carriers do this -- and why should we expect them to leave cash on the table -- then you can't shop by privacy. They're all take it or leave it, as disclosed in their PP.
https://www.verizon.com/about/privacy/vz-navigator-app-priva...