It's not about sending email. They hash the normalized email and use the hash to track activity across websites and services to build user profiles for real-time ad bids.

Fancy that, this requires an explicit opt in by GDPR.

That hasn't stopped them before: https://iapp.org/news/a/belgian-dpa-fines-iab-europe-250k-eu...

And of course with such a small fine it's basically guaranteed they will continue breaching it since it makes them way more money.

In theory yes; in practice, they'll track you anyway because it's not a crime unless you're found out, sued, and don't survive the lawsuit.

I'm sure there's a lot of "underground" data transactions happening where the source of data is obfuscated.

Facebook (of all places!) is one of the few companies that makes this transparent.

If you have a Facebook account, and live in GDPR-land, go check which companies illegally passed on your data (https://www.facebook.com/adpreferences/ad_settings -> Audience based advertising) and report them!

Step 1 in defending your privacy: Sign up to Facebook and give them your data.

Back when I actually used my Gmail account, I found LOTS of sites that would refuse to accept an email address with a + in it. I attributed this to a mixture of incompetence and active malice.

These days I host my own mail server and use . as the sseparator, which has been working well for years.

more likely the js snippet or regex they C&P from the interwebs disallowed it.

> incompetence

I stopped doing this after I encountered a website that accepted + in the registration form but not the email confirmation.

Them normalizing those addresses will allow them to track you across all involved parties, however.