[sintaxi]

> It's not allowed to keep state of the user without asking

I don't think this claim is correct. GDPR requires complete transparency with how personal data is used and stored. Asking for permission just happens to be the safest/laziest way to be compliant.

[stephankoelle]

What's a way to get consent without asking?

[PeterisP]

There's no way to get consent without asking (informed, freely given, opt-in affirmative action) but consent is just one of the paragraphs that give a legal basis for processing private data - it's legitimate to use data that's needed to fulfil the contract (e.g. the adress to deliver goods), comply with legal obligations (e.g. KYC in banking), for legitimate interests that don't conflict with freedoms of the user, for public interest (e.g. news reporting), etc (see Article 6 https://gdpr-info.eu/art-6-gdpr/), and all these use cases can be carried out without the user's consent. However, in some cases where the data processor could assert some other basis for processing, it may be simpler to just ask for consent.

But for the particular case of sharing data with thousands of third parties so that they can use it to target ads, consent seems to be the only one that applies. Direct marketing is one of the very few use cases explicitly listed in the GDPR, e.g. in the 21.2 'the right to object' - "Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing."

[salawat]

You realize that's an un-question, right? It doesn't even parse out.

You can't have consent without the assumption that there is a choice to be made, and that the choice is not yours to make, and that the one giving consent is aware of the choice. Anything with the characteristic of producing an implied voluntary choice without the chooser being aware the choice is being made is very specifically not consent.

[pmontra]

Sure, possibly with a contract signed before using the web service. Example: I sign a contract with a utility, maybe on paper in a shop in a mall, then I use their website to check my bills. If that's included in the contract I don't have to give consent again in the website.