As long as there's no control, your statement is worth nothing. Even if you are acting morally correct with the data, your future replacement might not.
PayPal were the good guys, too, until they were not.
In my opinion these tracking mechanisms are not GDPR compliant, as there's no opt-out possibility.