I think this is less about what websites are legally allowed to do and more about what websites actually do. I think a lot of these websites are not compliant with GDPR, but DPAs have been pretty timid so far in enforcing it.