Depends.

First, the content of HTTPS traffic might be encrypted, but some metadata (the domain name or IP address of the destination, for example) is not. You can use just that to do some tracking.

Then, if for example the ISP sees an user visits a particular website with poor privacy practices (let’s say, any social media run by big tech), they could do business with them and buy and sell data.

Lastly, but this is tinfoil-hat territory, what is to say they can’t leverage the biggest flaw in the global HTTPS infrastructure: they could manage to corrupt a certificate authority into giving them their root certificate keys (or at least into decrypting traffic they start logging and then pass over). This way, the ISP could read the traffic of any user of any service which uses certificates emitted by the corrupted CA. Very difficult that something like this happens because big CAs aren’t just ran by 1 omnipotent person, but technically 100% possible.

Side node: Tor solves the trust problem of the global certificate infrastructure: Hidden Services don’t work with trust on a CA, they work with just a public and private key system, where the only weak point is the server of the hidden service, storing the private key it uses to encrypt traffic and serve it to clients.
Edit: the server’s private key decrypts data the client encrypted with the server’s public key, and viceversa, idk why I always mess the 2 things up in my mind :P, but the point remains

on the website it sounds like it’s opt-in (via participating sites’ GDPR cookie popups), and it’s a new thing from a major european carrier, so i assume it was designed with GDPR compliance in mind.

(tag yourself; i’m the consenting laptop user sitting on the radio waves)