As you write: 'aim' and 'guidance'. But is it actually part of the law?
The GDPR is clearer that an indication of consent must be unambiguous and involve a clear affirmative action (an opt-in). It specifically bans pre-ticked opt-in boxes. It also requires distinct (‘granular’) consent options for distinct processing operations. Consent should be separate from other terms and conditions and should not generally be a precondition of signing up to a service.
The GDPR gives a specific right to withdraw consent. You need to tell people about their right to withdraw, and offer them easy ways to withdraw consent at any time.
If you make consent a precondition of a service, it is unlikely to be the most appropriate lawful basis.
So yes it's law, unless and until someone manages to appeal some interpretation of a point all the way up the chain.
Since most people press ok, it doesn't matter to also offer the service to those who cancel. Actually those people still leave a signal and you can show special ads to anybody who isn't part of the ok-clicker database.
I don't see how this would violate the GDPR:
- unambigous and clear affirmative action. People press ok and not the closing cross.
- no pre-ticket opt-in box
- distinct consent to advertisement processing
- separation from other terms
- not a precondition of signing up
- remaining right to withdraw consent
- ability to also tell people about their right to withdraw in that box
- possible to offer an easy way to withdraw
Actually withdrawal has to be as easy as consent. The law states:
>It shall be as easy to withdraw as to give consent.
That's the point where everybody is violating the law because the opt-out button is not constantly shown like the ok-button for opt-in.