My best guess is they will be able to shut this down hard, unless there is some alternative processing basis to be leaned on. See (6)1 for a list of potential bases.

So no. Not GDPR compliant in the slightest.