> if you create profiles to analyze the them for marketing goals. That's not correct; if you collect PII, even if you don't use it, you need consent. Actually,

> if you create profiles to analyze the them for marketing goals. That's not correct; if you collect PII, even if you don't use it, you need consent. Actually, if you don't have a legitimate use for the data, you are prohibited from collecting it at all. GDPR isn't an assault on online marketing; it's about privacy.