Replying to @gabrielazanfir and @PrivacyMatters, @buchtan, @CNIL
The important aspect (as I read it) is that the contract is overridden by controller accountability responsibilities. Just getting a consent string is not enough, irrespective of whatever a contract says: you need to verify your upstream.
♥ 3↺ 1