Hm I'm wasn't able to find any definitive sources to explain what GDPR does / does not allow in this case. Most of the articles I could find seem to think that

Hm I'm wasn't able to find any definitive sources to explain what GDPR does / does not allow in this case. Most of the articles I could find seem to think that GDPR would have prevented CA because it requires explicit user consent to access personal data. However it is unclear to me whether that consent needs to be from the user or from the users friends?