It would therefore necessitate the data subject's consent, distinct from the one given for primary processing, which this time certainly cannot be implied.
in order to validly consent for such secondary processing, the user would need to be throughly informed.