They can't legally, but for them to stop someone has to go through the process of proving this in court.

Where I live there are consumer protection state agencies that handle the suing for you, if the case is strong enough. You just have to file a complaint and I've had great success in the past.

And GDPR is taken seriously, the EU requiring and sponsoring agencies that check for compliance in all EU countries.

Don't know how it is in the U.S. but I imagine that at the very least you can group with others in class action lawsuits, such that the effort of any one individual will be lower.

As long as it is illegal of course, otherwise you don't have a case. I heard California is adopting something similar to the GDPR too.

In Hungary for instance, one can simply send an e-mail with the necessary details of the complaint to NAIH, the National Authority for Data Protection and Freedom of Information, and within the legally mandated period of 60 days, they will carry out the necessary investigation and enforce both national law and GDPR.