Under the GDPR you can hold and process user data if you have a valid excuse. If you don't have a valid excuse, you can still hold and process data if you get i

Under the GDPR you can hold and process user data if you have a valid excuse. If you don't have a valid excuse, you can still hold and process data if you get informed consent. “Sounds Good, Thanks” doesn't seem like informed consent to me, so it doesn't grant the site owner any extra permission.