In theory yes; in practice, they'll track you anyway because it's not a crime unless you're found out, sued, and don't survive the lawsuit.

I'm sure there's a lot of "underground" data transactions happening where the source of data is obfuscated.

Facebook (of all places!) is one of the few companies that makes this transparent.

If you have a Facebook account, and live in GDPR-land, go check which companies illegally passed on your data (https://www.facebook.com/adpreferences/ad_settings -> Audience based advertising) and report them!

Step 1 in defending your privacy: Sign up to Facebook and give them your data.

That hasn't stopped them before: https://iapp.org/news/a/belgian-dpa-fines-iab-europe-250k-eu...

And of course with such a small fine it's basically guaranteed they will continue breaching it since it makes them way more money.