That’s not at all legal under GDPR. Nor is having deny all be harder than accept. As is tradition however companies don’t give half a shit until fines start happening.