And the GDPR forbids them from writing that information (e.g. "the privacy nut bought apple juice") down or passing it to a third party without your explicit consent.