The GDPR way (in spirit) is quite good IMHO. The user needs to know at least roughly who, how and why their personal information is used. If it's obviously need

The GDPR way (in spirit) is quite good IMHO. The user needs to know at least roughly who, how and why their personal information is used. If it's obviously needed to provide the service the user wants, no explicit consent is usually needed. E.g. asking for an address without explicit consent is fine if you are sending them a package they have ordered. Asking for the address to sell it to someone sending mail ads is not. It's not about the data itself, it's about how it's used. Of course very few actually want their information to be used like e.g. ad companies use it, so the "consent" is tricked with dark patterns. And this trickery (and lack of enforcement) makes the law look bad.