Replying to @alextcone and @catsoo
The GDPR is more subtle than that, thankfully. Controller/processor determination is per processing. So a browser acting within user expectations is the user’s agent, that’s the design. But other processing, like indeed reusing your data for profiling, is separate.