Comment by denton-scratch

> if you create profiles to analyze the them for marketing goals.

That's not correct; if you collect PII, even if you don't use it, you need consent. Actually, if you don't have a legitimate use for the data, you are prohibited from collecting it at all.

GDPR isn't an assault on online marketing; it's about privacy.