[oezi]

Nope, the GDPR separates the action you perform on data from the purpose of such action. You need to collect consent for a purpose. X didn't state a purpose for why they would do any of these actions. Thus under EU laws their data collection is likely unlawful.

Adding a new purpose requires additional consent at least in the EU.

[gizajob]

Well you might be right but their lawyers don’t seem to share your concerns.

[maeil]

Their lawyers may well share their concerns, but in the case of X, those lawyers may simply be getting ignored. This isn't a normal company.