My reading here is that an "instagram lite" that:

1. Showed you posts

2. Used what posts you liked to show you more posts you'd like

3. Also used that data to show you ads you're more likely to click on

4. Didn't give you a free choice on whether they did (3)

Would still be illegal under the GDPR.

Yes, it is the post-hoc analysis that is the issue, not the "spying" which is just the modern-day spin on standard logging and business processes.

If you do not prefer term "spying", "voyeurism" fits as well.

Is Paul Graham a voyeur because his service, HN, records that you replied to my comment?

That’s my understanding as well. Point 4 being the key factor. They would have to ask, and give a clear yes/no option, on whether the user wants ads to be personalized based on their previous activity on the app (which posts they have liked, how many seconds they spent looking at posts, etc.) Otherwise, the ads would be based solely on the context that they are displayed in. Which seems perfectly fine to me.