Effectively, what GDPR requires. You must inform users what the data will be used for when asking for opt-in permission to use it, as well as offering opt-out and right-to-deletion.