I don't believe there is such a no objection rule - or perhaps I'm looking at it from a different angle - can you be more specific? Products and services aren'

I don't believe there is such a no objection rule - or perhaps I'm looking at it from a different angle - can you be more specific? Products and services aren't the issue; it's how you use+process users' data. Many products and services don't materially affect that, so won't require additional consent (e.g. if you're a company that sends news-updates by email to users that opted in, I don't believe sending them other updates is a PII issue - course, it might be spam, and IANAL). Also, products and services you're explicitly contracted for are exempt anyhow (e.g. if the user is paying you to remind them to take their meds on time, you don't need additional GDPR consent to store and process their sensitive personal data to the extent necessary to fulfill that contract - though other laws almost certainly apply to medical data).