GDPR have lots of board exemption.

When some processing is required by eu or eu member state law, that processing doesn't need explicit consent.

One could also argue the watermark tracks the generated content, not the person

That’s not how it works. If it can uniquely identify the user it’s personal information as per GDPR. And therefore illegal in this implementation.