since I don't have full understanding of GDPR what is to prevent companies requiring access being granted for any use of their website?

if you have exchanged funds with a site how long are they allowed to keep the data. there are tax implications regardless

In short, under GDPR a company isn't obligated to offer you services if you refuse to allow them access to information they require.

GDPR defers to data retention laws for all other purposes.

Your data on FB is worth precisely one thing to them: the ability to target you with ads on FB. When you don't use FB, it's useless to them.

Except if that data is shared with third-parties for profit. Then the data may be useful to them even if you are not logged on. Since they also track you from any other page that uses their API / share buttons, this "worth" does not necessarily decrease regardless of usage. You also cannot easily (or at all) revoke these third-parties' access to your data.

Add to that the risk of them not providing good enough security regarding access to the data (such as with the Cambridge Analytica case), and giving them access to so much of your data becomes an additional problem to consider, since you have no control over that data sharing whatsoever.

Facebook ad targeting does not require you to use Facebook.

Facebook Audience Network is a display ad network like Adwords.

It's deployed widely across the web and mobile apps.