That's not fully accurate either. All that you wrote is true, but user's permission must be freely given - this means access to the service cannot be restricted if user refuses to give permission (as long as that permission isn't strictly required to provide the service itself, but then probably permission is not the right basis for processing data).