I think you'd have to be a GDPR lawyer to understand the implications of that. It can get a little complicated.
Cue re-running the training model a little bit more frequently than they'd like... At least it would certainly become opt-in very quickly, which of course it should have been from the start.