Opt-in is not prohibited though, so it is legal to provide the option to use personal data for advertising purposes (or pretty much any purpose for that matter) as long as it's optional, clearly explained to the user and defaults to off.