AFAIK training on API is opt-in, training on the consumer interface is opt out. And one must also say that there are enough levers in the GDPR to argue a legal

AFAIK training on API is opt-in, training on the consumer interface is opt out. And one must also say that there are enough levers in the GDPR to argue a legal basis for processing PII, not the least of which is the catch all "legitimate interest". But you need to implement appropriate controls, otherwise data privacy regulators will complain.