The explicit consent request is what they can do. It should have been there from the start, but better late than never.