That's not true. The law restricts what companies can do with my data even after I consent to their treatment of my data.