I think that it's a matter of implementation, because all you need really is the order correlation, not the user that passed the order. So

- if you keep a reference to specific user (like "your friend toto bought this") then you need consent

- if you keep a reference to "user category/generic profile" then it's anonymized so no need for consent

- if your profile is build on all the orders of your different users but without user informations, then it seem fine to me... because of anonymity