The screenshotted example is nothing new, I've seen that specific thing at least 6 months ago. I don't think it has anything to do with GDPR, and as others have already mentioned it is not likely to be legal under it.