EDIT ---
Ok, I get it now. Personalized ads = surveillance. Fair enough.
Doesn't the whole GDPR already cover it though? You can opt out of the surveillance.
Or by giving you the "choice" of paying an absurd amount of money or "freely" consenting to them harvesting all your data, which is what Facebook has already announced is the next step they'll take. Whether this is legal or not under GDPR is hotly debated. While that debate is running, Facebook will happily continue (if you pay to "opt out" they'll make even more money off you, so win-win for them). If the debate concludes that it was illegal, they'll either get away with it because "it was unclear so we can't punish them", or they won't, and they'll pay a fine that at that point will represent a small tax on the additional profits they made through this practice.
Either way, they win, consumers lose, because GDPR enforcement takes 5 years per round and multiple rounds...