GDPR works like this. You need consent to process data vs the US whwre its just a free for all
Im theory yes. In practice, we have "legitimate interest".