Just putting it in the privacy policy isn’t good enough. The general consensus is that unless you’re claiming another legal basis for your processing of data (which would be hard to argue here), consent needs to be informed, opt-in, and granular per usage. I don’t see evidence of that in this story.