I had long assumed they were doing it anyways. Once it's out there, is there really any rules?
Yeah we were definitely scraping data and using it (or rather, intending to use) for commercial purposes.
As for rules, the GDPR is going live end of May, and it wouldn't surprise me if they had already identified someone to royally fuck over just to set the example that will scare the shit out of everyone else.

But the general feeling is that companies are complying. We were doing stuff in violation of the GDPR, but we aren't anymore.
One of the best parts of the GDPR is that you can withdraw consent to data gathering. Like, facebook can't claim that "i forgot to unclick that box five years ago, so now my data is theirs forever". I have the option to decide that they can't keep my data anymore, and fb will have to delete.
I am also entitled to be informed about every single shred of data facebook has collected on me, will be interesting to see what that looks like in reality. I'm probably going to request a printout just to see what they have.