[bondarchuk]

>not to send users' personal data to third parties

>receive their users' informed consent to such sending BEFORE that sending occurs.

Neither of these are what's actually happening in this case. According to this court's decision, the responsibility of the website owner is not to send instructions to the user's machine that might expose their personal data to third parties after the user's machine follows these instructions, OR receive informed consent before such instructions are sent. I'm not saying the GDPR doesn't apply here, but at least it's clearly a different situation.

[maratc]

IANAL but

   For the purposes of this Regulation:
   (1)
   ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person

   — Clause 26 of GPDR [0]. 

Whereas I would point out the directly or indirectly part, the latter of which happened here.

[0] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...