That's a rhetorical question I hope? In case it isn't: yes, that's against the GDPR that requires that when data is collected the purpose of the collection is stated and consent is obtained for the use of the information for that purpose. No consent->violation of the law.
However, you are right in saying that this violates the GDPR, because the data was collected for a different purpose, and using it for another reason like advertising is not allowed.