> [users] do not know that they are giving up their data, that it is sold on a market I agree that this is a big one, and I believe that businesses indeed shou

> [users] do not know that they are giving up their data, that it is sold on a market I agree that this is a big one, and I believe that businesses indeed should explicitly and plainly let users know what kind of data is stored and how it is used. However, isn't one of the main issues with GDPR the fact that it doesn't give users an option to enter in this kind of relationship with a company, even if both parties are aware and consenting? I am not a legal expert, but I thought(according to my understanding of GDPR) that businesses are not allowed to store personal data about users, period, unless the data is needed to provide the service. I have no idea if "we need this data, so we can use it for ads to earn the revenue needed to finance our service" qualifies as "needed to provide the service", but I always thought it didn't. I will be happy if someone could clarify this point and, potentially, prove me wrong.