I think GDPR should already covers this. What I’m unsure about is whether accepting one of the items in the menu on purchase of the car then allows it again because of “giving consent”.