Perhaps they claim it's "anonymised" (which generally means it's still grouped but assigned a number instead of a name), thereby handily circumventing this requirement. I would be more hesitant to assume that just because the GDPR passed, the big guys are already as compliant as you would expect from it's wording. It's much more likely they're maliciously complying, because this nets much more money.
