It's not a violation of GDPR. However, is somebody makes a GDPR request to retrieve all of their personal data, or to delete their personal data, then they must comply within 30 days. They have to organize their datasets to make these operations easy.

There are six legal bases for processing personal data under the GDPR. Which do you think applies in this case?

Additionally, sexual orientation is subject to special rules under the GDPR and cannot be processed at all without consent (and some edge cases). That could possibly apply as well.

I think the site would require that the visitor give consent when they visit.

You're not allowed to require consent in exchange for access to content.

Really? Where is this rule stated in the GDPR?

Article 4 section 11 defines "consent" as something that must be freely given. [1]

Article 7 section 4 further clarifies that consent is not freely given if provision of a service is conditional on consent. [2]

Recital 43 is super clear: "Consent is presumed not to be freely given if... the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance." [3]

The gdpr.eu website unpacks the legalese: "“Freely given” consent essentially means you have not cornered the data subject into agreeing to you using their data. For one thing, that means you cannot require consent to data processing as a condition of using the service." [4]

[1] https://gdpr-info.eu/art-4-gdpr/

[2] https://gdpr-info.eu/art-7-gdpr/

[3] https://gdpr-info.eu/recitals/no-43/

[4] https://gdpr.eu/gdpr-consent-requirements/

Maybe they had to change their practices after GDPR. I met him before that was passed.

How long do you think GDPR has been around for? Why do you think it was passed?