[mjewtoo]

For consent this is true, but there are other legal ways for you to collect the data. One is legitimate interest, this one is more abstract but requires a bit more work from you.

I think a lot of the future court cases will be around trying what one can use legitimate interest for.

https://ico.org.uk/for-organisations/guide-to-the-general-da...

[GordonS]

Legitimate interest is meant for when it's in the user's best interest... but I've no doubt that, given sufficient lawyers, Facebook et al could argue almost any data-hoovering is in their users best interest