It's not as bad as you imagine. Essentially, you can use data if you have consent, if you need it for a contract, if you need it for some "legitimate interest" (complicated), if you need it for regulatory reasons, etc. So there are plenty of avenues for using the data. The key is that you have to say up front under what "lawful basis" you are using the data. Each "lawful basis" has specific things the user is allowed to do and things the user is not allowed to do.
If you choose the consent lawful basis, then the user is allowed to withdraw consent. In fact, they are allowed not to give consent in the first place. If you choose the contract lawful basis, then the user can't withdraw without cancelling the contract. However, they can object if they believe that there is no reason you need the information to complete the contract. If you choose "legitimate interest", then the user can object and you have to show that the interest is indeed legitimate and that there is no other way to do what you are doing without the private information. One of the things explicitly prohibited is profiling. So it's quite complicated.
The key is that once you have informed the user of how you are going to use their data, you can't change your mind (within the same business context). This means that you have to be very, very careful. If you decide to use consent (in my example), but you should have used contract, then you are in big trouble. If you say that it's part of the contract but it's not strictly necessary to provide service, then you are in big trouble. Etc, etc.
One thing that I think will be very interesting is under what lawful basis FB publishes your real name. If it's consent, then you can withdraw it. If it's contract... do the really need you real name to give you service? Legitimate interest... Yes, potentially, but I don't see how they will get away with sharing your name with the whole world.
I'm very much looking forward to seeing how it pans out.