I think these are the relevant parts: > When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance o

I think these are the relevant parts: > When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. From https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/ paragraph 4 And the definition of consent is here: > ‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her; From https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ paragraph 11 --- 'specific' and 'unambiguous' in combination seem to disallow the "bury it in the TOS" cop-out. 'informed' and 'specific' in combination seem to disallow the opt-out cop-out (since a opt-out permission is never specific, and basically never informed). Article 7 paragraph 4 (the first quote) seems to disallow the usage of data unless it is necessary for the service. Of course this is still all pretty untested in the courts, and IANAL but to me it seems pretty clear. If your primary service is not building a machine learning model based on your own users data you will need to get your users to opt-in for that specific use-case.