For any personal data collection, explicit consent from the user is required. An online store can only collect data necessary for the purpose of the service. So it has to ask for my explicit consent to legally collect personal data required to deliver a package like for example my name, address and phone number, but can't ask me about say, my marital status or religion.