They've most likely been mislead by very poor advice on marketing communications. Under GDPR a company can rely on "legitimate interest" as their lawful basis f

They've most likely been mislead by very poor advice on marketing communications. Under GDPR a company can rely on "legitimate interest" as their lawful basis for processing for marketing purposes. However, this ignores the older PECR rules that say that electronic marketing requires consent. Requiring users to agree to the a new privacy policy or updated terms and conditions is obviously still fine. GDPR does not restrict companies from requiring that their users agree to terms as part of their provision of services. As far as I can tell from this post, the only problem is that GitLab have used the guidance for postal marketing when they're doing electronic marketing. Yes, it's not compliant, but references to the UDHR and the general tone of this suggest the user has a prior grievance and they're trying to over-inflate this issue.