They aren’t allowed to do whatever they want with your data, there’s strict restrictions on requiring consent for things you want to do with user data.