Well, it's wrong in the sense that profiling activities require a "lawful basis", consent is one of the possible lawful basis available.

So you can profile without consent IFF you can convincingly justify said profiling via one of the other lawful bases. But those won't really let you do blanket profiling willy-nilly either and come with other strings attached.