Of course... or he can say that you could use another resources that is GDPR compliant and/or privacy preserving.

YOU provide the service so YOU are responsible for the way your user's data are processed and must ensure that it's processed according to the rules (requiring consent when necessary)