Yes, there's an exception in the GDPR for explicit consent to ML:

The regulation identifies three areas where the use of autonomous decisions is legal: where the processing is necessary for contractual reasons, where it’s separately authorized by another law, or when the data subject has explicitly consented.

But, again, nobody's going to consent - after encountering countless permission popups on websites each and every day, most will just be hitting "decline" without reading what is being asked.

Users will still have to consent for ML treatment of their data if they want to use ML based services. Base whatever service you offer around it, and they'll have to either accept or get no service. The only ones losing on this are the intermediaries who up to now could slurp whatever data they wanted and sell it to third parties, while now they'll have to offer something of value to the user or get no data.

That's a novel claim, usually security experts are always complaining that people just click "accept" and ignore all the warnings of broken crypto and all that. How foolish they will feel when they realize that all that was missing was putting "GDPR" in the popup and people will automatically stop ignoring warnings!

The difference is that before, they had to click accept in order to receive whatever service they were trying to obtain. Now they don't. Also, the sheer number of consent dialogs they will encounter will rise exponentially.

> The difference is that before, they had to click accept in order to receive whatever service they were trying to obtain. Now they don't.

This doesn't receive nearly enough attention.

all it takes is a celebrity tweet to tell them to click "decline" and it becomes a meme.