They mean via an explicit permission dialog. Not something hidden in the TOS/Privacy policy
If you've spent even a minute working in the marketing world, you'd know that yes, yes they do. They think exactly that far, and then about another 10 steps beyond that.
Those prompts are most definitely designed to be willed away by the user without allowing them to fully grok the consequences. Unfortunately, it's not measurable, provable, or enforcably illegal.