Consent is mostly relevant to all the marketing and customer analysis activities, which aren't essential to the service, so can be refused, and would be severely curtailed as users stop consenting to these uses of their data.
They are already profiting from the service they provide but they still give (Sell! I bet they can use a different terminology but essentially this is it) the users data to other companies.
Those are the companies that brought GDPR on all of us, and those are the parties that should be punished with 4% global revenue, multiple times.
I bet everyone will be shocked what the companies are doing with our data, from our banks, credit card companies, insurance companies,... i think that everyone (or most) will stop complaining about GDPR and want it for their country too.
Just an example, what gets delivered just for Facebook: "Advertising ID and device ID to segment user groups based on app behaviour, encrypted e-mail address associated with PayPal users (without indicating account relationship), IP Address, Anonymous ID generated by cookies, pixel tags or similar technologies embedded in webpages, ads and emails delivered to users. Mobile advertiser ID, IP Address and other metadata via Facebook SDK in mobile apps."
Encrypted e-mail address? Why encrypted, not hashed? IP? Why the FB needs my IP on connecting to paypal? And the list goes on and on. If GDPR will stop this the whole world will benefit.
Of course they need to share data with payment providers (like a bank), or else they won't be able to get or deposit your money.
Of course they need to share data with auditing firms, or else they won't be able to do business in certain countries.
Of course they need to provide customer service.
Of course they need to check for fraud.
etc.
What do you expect Paypal to do in those cases?