Each user independently gives permission to collect this data?
As far as I understand, no. This may be legally justified: Information about purchases and orders belongs not only to the buyer, but also to the seller of the product or service.
Pretty interesting opinion. I didnt even think that this situation could be viewed from another angle.