Companies must give clear, plain-language notice seeking informed consent with itemised data description, processing purpose, complaint mechanisms, and easy consent withdrawal process where ease of withdrawal is comparable to the ease with which such consent was given.