As I understand it, the GDPR is primarily concerned with user's privacy. You can't have an opt-out if you want to sell data about the user - like name, email, browsing history, and that kind of stuff.

Data created by the user - such as a youtube video, HN comment, or whatever you want to call Figma - is probably still a wild west. That's more about intellectual property than privacy. The ToS of pretty much every single platform has included a mandatory licensing clause for ages, giving them the rights to do pretty much everything they want to.