This ruling has nothing to do with opt-in or consent. It has to do with the concept of data minimization. According to the GDPR you should only process as much data as necessary and this applies no matter what legal basis (eg consent) you have. So basically the point with GDPR is that you as a user should not even have to care, the company that processes your data is responsible to care for you. And it's actually cool that we see this enforced now.