I just replied elsewhere in the thread regarding this. Consent to collect was acquired, but nothing actually says they're processing this data for marketing pur

I just replied elsewhere in the thread regarding this. Consent to collect was acquired, but nothing actually says they're processing this data for marketing purposes if you haven't opted in to it. I've seen this pattern quite often: The opt in/out flag is stored somewhere and companies invalidate the data they have based on that in the marketing tooling itself; collection still happens regardless. I've not used it but it's even possible Braze has information on the optin/optout and the ability to immediately reject data about optouts. The reality is that, while the clean and intuitive privacy practices we're talking about are compliant, they're not required for compliance. Companies go the least-effort route. Deliveroo has clearly done a GDPR pass on their practices so I highly doubt they're using the data in question for marketing (even if they're collecting it). But I'm still encouraging you to go and talk to them about it. I promise you if you're polite and clear about what and where the issue is, you can likely get some changes done. It's pretty fulfilling, too :)