Nope, the GDPR separates the action you perform on data from the purpose of such action. You need to collect consent for a purpose. X didn't state a purpose for why they would do any of these actions. Thus under EU laws their data collection is likely unlawful.

Adding a new purpose requires additional consent at least in the EU.