Not an expert at all, but my basic understanding of GDPR is if you outsource a service to a 3rd party and they collect data or do any processing that they shouldn't, you are essentially responsible.
This being said, it feels unfair when you try to comply but somebody fucks you over.