Yes, but this is a different thing. It's clear that you are not private, even using TOR, if you use Google for search, post on Fakebook or use another page/service which logs and profile your activity, but it's different if the browser itself or/and its company is tracking you, sharing it with third parties. That is the point. GDPR limit this to an minimum, but don't avoid it completely. More than ever is important that you ALWAYS read TOS and PP of every app/service before using it. A good rule is: longer and more written in a legal jargon, difficult to understand and many external links, it is a sign that the app or service is trying to hide its activities and dark patterns by boring the user. A honest app/service don't need this tricks, using a short and clear text.

Depends. Every hostname accessed? Sure. Every full URL? Not with https being everywhere these days.