With the ruling dated August 31, 2021 (Az. August 31, 2021), the Federal Administrative Court of Austria ruled that data controllers can base the data processing after an invalid consent on another legal basis according to Art. 6 Para. 1 GDPR – even if this is not mentioned in the privacy notice!
https://www.ris.bka.gv.at/Dokumente/Bvwg/BVWGT_20210831_W256_2227693_1_00/BVWGT_20210831_W256_2227693_1_00.html
[protecting people by good design, solid security, efficient processes and trusted services]