Permission is one basis for lawful processing. There are others. A bunch of websites have been mislead into thinking that GDPR forces them to get permission for everything, or that them having permission allows them to do what they want.

They are wrong.