>If the data protection authority or the law is to be believed, that's not freely given consent It's not. You can report this to an appropriate civil authority

>If the data protection authority or the law is to be believed, that's not freely given consent It's not. You can report this to an appropriate civil authority and in theory it'll be resolved (possibly with a fine). In practice the authorities are still so overwhelmed by GDPR that they will only look at the most severe high profile cases. Fingers crossed one day it'll improve...