I'm pretty sure you can't "sue" under the GDPR. The best you can do is report them to your country's privacy regulator but so far all of them are absolutely incompetent or unwilling to enforce the regulation.