1. you don't need consent for functionality strictly required for the functionality of your product. Such as session management 2. You are allowed to legitimat

1. you don't need consent for functionality strictly required for the functionality of your product. Such as session management 2. You are allowed to legitimately process PII for legitimate purposes related to your business: e.g. combating fraud 3. What you emphatically aren't allowed without consent: collect vast amounts of data, store it indefinitely, and sell it to 15 000 third party "partners"