It's really not that hard. Under GDPR you have a right to privacy, and companies can't demand you give it up as part of some kind of condition to gain access to their service.