Liable for what? GDPR says you can only collect data if you have informed consent from the user. It does not imply any right on the side of the business to be able to obtain such consent.