Thinking about it (and having just gone through my 4th GDPR course in 2 years), I think that they are on very dodgy ground, unless you actively agree to the usage of data for named purposes they can't use it, they would have to ask do you agree to us selling your browsing history, I don't think that they can bury it in T&C's. You should be able to ask for a DSAR and request the data that they hold on, anonymisation is not enough if it can be reconstructed, and the penalty is a maximum fine of 4% of turnover. Breaches are normally thought of in terms of data exposure but this also qualifies.