That is only if you use consent as your lawful basis.

The reason why nearly everyone is using consent currently is because the other straightforward one which is:

(f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.)

Is so vaguely defined as far as benchmarks go and no one is up for taking the risk of being at the mercy of the judgment of 28 different regulators and court systems.