In context of the cited article, the assumption is the data was already collected. My posit is that should not be allowed. I do not expect companies should be able to collect and then ask for consent. They should be subject to criminal behavior if they do so before and without explicit request.