GDPR is NOT entirely opt-in. For reasons of ‘legitimate interest’ a consent-less collection is warranted (ie. to perform the service). Yes, this does usually excludes data collection for marketing purposes. But it’s important to state that it’s not Entirely opt-in.