You indeed only need to seek consent when there is no other legal basis for collecting user data. Other legal bases include fulfilling a contract with someone (shipping something to their home) and if it's a vital interest (like saving the person's life by looking up their blood type by their name in a database).
On the other hand, GDPR also says you have to inform the data subject about the data processing, who you are, their rights, etc. Whether a link to the privacy policy at the bottom is enough, I don't remember off the top of my head, but I think so.