IANAL either, but my research confirms this also. A lot of companies up to now have used opt-out as their skewed version of consent. GDPR raises that barrier mu

IANAL either, but my research confirms this also. A lot of companies up to now have used opt-out as their skewed version of consent. GDPR raises that barrier much higher, however, some of those use cases of "older style consent" may very well fall into legitimate interests or performance of a contract. One of the main things about GDPR though is getting companies to give a monkeys about the rationale for the data collection - even if they use the legitimate interests argument, part of it is that they now have to actively prepare for that, show the legitimate interest and rationalise it to regulators.