> Why would the GDPR even describe consent and consent in relations to contract, then?

Freely given consent is a lawful basis, allowing for processing even if it's not necessary for legal/contractual reasons that would qualify the processing for another basis (or a mix of necessary and unecessary).

But here they're clearly not meeting the "allow separate consent to be given to different personal data processing operations" requirement, and if they only met the second requirement (can't make performance of contract dependant on the consent to processing beyond what's necessary) by nature of all of their processing being necessary (which I feel is highly doubtful) then it seems like they would've already been covered by the "processing is necessary for the performance of a contract" basis. Though as before I'm not a lawyer.

> That's an obviously disingenuous interpretation of my point.

Necessity for the performance of a contract is a lawful basis for processing under the GDPR, and to my understanding you're suggesting "necessity for the performance of a contract" should be interpreted loosely to include a kind of "financial necessity" that permits selling personnal data to adtech companies.

To me it seems like that same justification could be used for any selling of personal of data (maybe I go too far by saying any processing, since it wouldn't necessarily justify non-commercial processing). If you don't think that's a consequence of your interpretation, I'd be interested to hear why.

> This implies a right to access commercial websites for free, which cannot be reasonable, or only a choice between no access and payment, which also cannot be reasonable.

Websites can use most forms of monetization they always have - just not selling of personal data (unless the user freely gives consent). Regular ads, selling an ad-free version, upsell nags, all the badges/superchats/cosmetics/etc. are all still fine.

▲

mytailorisrich a day ago | parent [-]

> Freely given consent is a lawful basis, allowing for processing even if it's not necessary for legal/contractual reasons that would qualify the processing for another basis (or a mix of necessary and unecessary).

Again, this is all a narrow and militant interpretation of "necessary for contractual reason", not least when all data show that the people are fine with it. In a contract, a form of quid pro quo is necessary, if targeted ads are the form of "payment" asked and if there is no imbalance of power or coercion (and it's hard to see how being refused access to a random website any sort of coercion or serious negative consequence) then there should be no issue and the "deal" is actually the main aspect of the contract. Any other outcome is either that the GDPR is badly drafted or that this is an ideological agenda at play (obviously I favour the latter).

	▲	Ukv a day ago \| parent [-]
		> Again, this is all a narrow and militant interpretation of "necessary for contractual reason", Given "necessary for contractual reason" is on its own a lawful basis, I don't see how your interpretation (that selling your data to ad companies is "necessary") wouldn't effectively nullify much of the GDPR, allowing pretty much any use of customer data to be justified so long as the company makes money from it. The European Data Protection Board, whose purpose is to ensure consistent application of the GDPR, has written: > > If there are realistic, less intrusive alternatives, the processing is not ‘necessary’. Article 6(1)(b) will not cover processing which is useful but not objectively necessary for performing the contractual service [...] even if it is necessary for the controller’s other business purposes. > > A controller can rely on the first option of Article 6(1)(b) to process personal data when it can [... establish ...] processing is necessary in order that the particular contract with the data subject can be performed. [Emphasis in original] > > does not cover situations where the processing is not genuinely necessary for the performance of a contract > > it is required that the processing is objectively necessary for a purpose that is integral to the delivery of that contractual service > > Example 2: The same online retailer wishes to build profiles of the user’s tastes and lifestyle choices based on their visits to the website. Completion of the purchase contract is not dependent upon building such profiles. Even if profiling is specifically mentioned in the contract, this fact alone does not make it ‘necessary’ for the performance of the contract. If the on-line retailer wants to carry out such profiling, it needs to rely on a different legal basis. (https://www.edpb.europa.eu/sites/default/files/files/file1/e...) > not least when all data show that the people are fine with it. Doesn't appear to be the case when the case when it's actually a freely given choice (as low as 0.1% when it's opt-in) - which is why companies fight so hard to manipulate user choice with dark patterns and obfuscation, or outright breaking the regulation.