It isn't. Provided you got consent, defined the scope in which the data will be used and is held accountable to not change the scope without clearly asking for consent again.

This also requires the user to trust you will act within the scope defined, and that can be hard to verify. From a user perspective it's generally safer to just not grant consent.