Not so. In fact, the GDPR specifically states that user monitoring is legal when necessary for the purpose of preventing fraud and for targeted marketing.  “The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned. The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.” Recital 47