This isn't right. Consent is just one of six legal bases through which you can lawfully process data under GDPR.
https://ico.org.uk/for-organisations/guide-to-the-general-da...