A big thing in GDPR is that consent must be sufficiently specific and explicit. Long and generic T&C might no longer pass. Ultimately, I imagine the regulation will make a lot of lawyers richer as this kind of stuff gets hammered out in practice.