I think that it's a matter of implementation, because all you need really is the order correlation, not the user that passed the order. So - if you keep a refe

I think that it's a matter of implementation, because all you need really is the order correlation, not the user that passed the order. So - if you keep a reference to specific user (like "your friend toto bought this") then you need consent - if you keep a reference to "user category/generic profile" then it's anonymized so no need for consent - if your profile is build on all the orders of your different users but without user informations, then it seem fine to me... because of anonymity