In context of the cited article, the assumption is the data was already collected. My posit is that should not be allowed. I do not expect companies should be able to collect and then ask for consent. They should be subject to criminal behavior if they do so before and without explicit request.
See e.g. F.J. Zuiderveen Borgesius, Security & Privacy, ‘Informed Consent. We Can Do Better to Defend Privacy’, IEEE (Volume 13, Issue 2, p. 103-107).