It's been a hot minute since I've had to think about GDPR but it needs to be an obvious and positive opt-in. Hiding it in the T&Cs shouldn't count. It needs to be a button that says, "Request an irritating call back." Might start reporting EAs to the ICO and see what happens.