GWR is to blame for that. They're seizing the opportunity presented by having one more interaction (among many) with you, to saddle that interaction with this ratchet pattern. There's nothing special about GDPR that leads inexorably to that.