Comment by hugoroy

I doubt you actually asked any lawyers who know this stuff.

While GDPR did raise the threshold of valid consent, the interpretation before the GDPR was nowhere near what you describe here.

There are authority guidelines and sanctions predating the GDPR on this.