But GDPR and CCPA ban this practice as far as I know. So, how are these tools still legal ?
I am not being critical only curious :)
It has also become a lot easier, unfortunately, to get that consent.
Both the convoluted legal framework itself and the dark patterns that arose from it (such as the "Allow everything" button being the primary action button and "Privacy settings" being a small, obscure link) are prone to putting off users, who more often than not will just click on anything just do get rid of those annoying pop-ups and banners.
> It is allowed to sell personal data under the GDPR subject to receipt of consent for it from data subject and compliance with the rights of data subject even if it decided to exercise the right to object or the right to be forgotten.
Source: https://legalitgroup.com/en/gdpr-requirements-to-selling-of-...