Consider a company which offers two services - 1. Latest news stories with personalized ads on the side. 2. Just news stories. There is nothing illegal about h

Consider a company which offers two services - 1. Latest news stories with personalized ads on the side. 2. Just news stories. There is nothing illegal about having the above two lines of services. But when a user wants service no. 1, their personal data becomes neccessary to show personalized ads. If the user chooses to not “pay” in the curreny of personal data, it is perfectly fine, they can use service no. 2. Why is this illegal? Please, be specific with which part of the law prohibits this. Morally, ethically, I agree with you. 100%. I was in fact involved in a spread-the-word about GDPR campaign few months back. This discussion is about the legality and the technicality.