GDPR doesn't change contract law - they're orthogonal. It is true that in the everyday meaning of the word "consent", you would "consent" to a contract, but tha

GDPR doesn't change contract law - they're orthogonal. It is true that in the everyday meaning of the word "consent", you would "consent" to a contract, but that is not at all how it is being used in the GDPR - the consent is to the one-sided, without consideration use of your private information. It has nothing to do with consenting to anything else, whether the formation of a contract or the shaving of your dog. While I applaud you going to the source, your reference: "How to get that consent is outlined in https://gdpr-info.eu/art-7-gdpr/" https://gdpr-info.eu/art-7-gdpr/" does not mean what you think it means. It is simply a specific callout to emphasize the "freely given" aspect of consent (and NOT contracts) and remind enforcers that refusing to perform or taking some out from performing a contract should be considered undue pressure to get consent and therefore not "freely given". For instance, an extreme example would be if, after you ordered and paid for a pizza, and after I agreed to make and deliver you that pizza, I subsequently threaten to breach that pizza delivery contract if you don't "consent" to give me a complete list of movies you've watched this week. ALthough we do have a contract, we're not forming a new movie-history contract because I'm not offering anything for it or agreeing to do anything. I'm just using that pre-existing contractual relationship between us to threaten you into something that you may not want to do. They're completely separate concepts. Note the phrase "inter alia" which means "among other things", which is a signal from the authors that this is not the only consideration on "freely giving" consent. It has nothing to do with consenting to form a contract. Note also the word "performance" as it relates to a contract, which is completely distinct from "formation" of a contract. Furthermore, you've (theoretically) been forming contracts with these websites every time you visit them and accept their ToS and privacy policies and whatever else you click "OK" on - just go read them. They restrict you from many things that you could possibly do (reverse engineering, automated scraping, etc) in consideration for serving you up the content. GDPR is just another line item to add into that list for you to accept in the (theoretical) contract. Lastly, I keep saying "theoretical" because at least in the US, I'm not aware of a direct case on the topic of whether website ToS are actually enforceable. There's a click-wrap case that is close, but other than that....