Considering this is tracking, processing, and transmitting data, and algorithmically making decisions about users, why doesn't this show up in their privacy policy, nor in their GDPR exports?

Sounds like a very expensive lawsuit waiting to happen (GDPR allows fining up to 4% of global revenue, not profits)