It is a grey zone. Some of the data protection authorities in EU have said that it's okay to do pay or consent while others have said it's not okay and it hasn't been tested by the EU court yet.
As so often, the biggest GDPR problem is missing enforcement.