I think the disk space and bandwidth are what make consent needed, because it’s implied that the browser may download small pieces of data but the user would not expect such a large file be downloaded so it should check with them