From what I understand, the GDPR also disallows denying users access to a site if they don't consent to an unrelated data collection.