Exactly. GDPR is around the corner and any private data without explicit consent to be targeted for marketing is going to be useless at best, a liability at worst.

Explicit consent means the company must be able to prove the user consciously agreed to receive marketing. Which is excellent. 1) the burden to prove it lies with the one holding the data and 2) you can't tuck it away in legalese fine print.

I bet a lot of companies are going to do like wheterspoons and just purge the data rather than attempt to make it legit.