Why does this exclude a broad clause, e.g. one that states that the data is used to show the most fitting advertisements. You can see that purpose on many webpages. Almost any current data processing will fall within that area.
In conclusion, I still think that you can sign away the right to process your data.
> The extent of tracking makes it impossible for us to make informed choices about how our personal data is collected, shared and used, says Finn Myrstad, director of digital policy in the Norwegian Consumer Council.
The Council's point is that the average consumer is not capable of meaningful consent due to the extent and obfuscation of the tracking involved. Much of contract law, afaik, requires a person to be capable of consent at the time of signing for a contract to be valid. The Council's argument, therefore, is that even if technically a consumer has "signed away" the right to process their data, the contract is not valid because the consumer is not able to, and/or cannot get the information required to, make an informed choice when signing.
This isn't true. The actual GDPR text on consent states [1]:
the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
-> So processing of data based on consent is limited to the purposes agreed to.
or
processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject
-> So processing of data is necessary to fulfill a request made by the data subject.
This is a far cry from "processing the data which you have signed away". The only blanket allowance for data processing is this item:
processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data
Which again limits the processing allowed under GDPR: processing of data under this rule requires the legitimate business interest to be weighed against the subject's personal rights.
[1] https://gdpr-info.eu/art-6-gdpr/