Actually that's a reason why we need laws like GDPR: I don't have an Facebook account but random websites I visit still have elements embedded from Facebook. I've never agreed for Facebook to store my data but they can only give their word they won't collect my data (which, AFAIK, they don't give).

I've got no recourse against this - or maybe I have because Facebook is big enough that it's worth it to create targeted block lists. But against the next 20 smaller companies who do the same?

This is why there needs to be something else than just blindly trusting everyone out there. Because someone will not play fair if theres a competitive edge to gain.