GDPR states that consent must be freely given. If there are financial incentives, the consent may be invalid.