At the bottom of the page they have some notes on GDPR, they explain their "lawful bases" for processing:

"When we have a legitimate interest in processing your personal data to operate our business or protect our interests (e.g., to provide, maintain, and improve our products and services, conduct data analytics, and communicate with you)."

It looks like they claim legitimate interest. If I understand it correctly they make a claim that their use serves a business purpose (like for example limiting the amount of free articles), and the impact on your privacy is minimal. Which could be possible, for example Medium does not do ads afaik.

If that's the case I think you should still be able to "object" to the processing with a reason. At the bottom it says:

"You may object at any time to the use of your personal data by contacting [email protected]."

Might be something to try.

I think it depends on if their claim of legitimate interest is valid. That can only really be tested when it's investigated after a complaint. But there is definitely some thought behind it, and I bet they had some lawyers work this out.

Personally, I think it would be better if they just asked for consent, but then they probably can't do the X free article paywall thingy.