No, consent is just one of the legal bases you can use to justify handling someone's personal data, legitimate interests is another. Their privacy policy should explain if they're using another basis. The ICO have a list of the valid bases https://ico.org.uk/for-organisations/guide-to-data-protectio...