That's been ruled illegal in the EU, but EU sites still do it. Basically, the consent exception only applies if the user isn't coerced into it. Because coerced consent isn't consent.