It’s about the part where they can’t hide the data collection in the terms and conditions of the site. You have to have a separate clear consent step for them to collect the data.