Good question :)

I think if it's all client-side, not logged or retained, and is not transmitted to third parties, it should be fine.

IANAL

Without permission yes, if it stores it (but that would probably just be client-side).

If it stores it and uses it for matters different than what explicitely advertised when you consented to it, than yes it's even worse.

edit: just saw that's a service they resell. So yeah it is against GDPR

Yes, almost certainly so. You did not consent, they have no legitimate interest to track you, and you were never informed about the what and why in plain language.

The GDPR isn’t the complex legislation monster people make it out to be, but for the most part common sense about handling sensitive data.