Apologies in advance if this is not the correct exchange for this question.
I am a developer working for a company that owns a healthcare application. They operate exclusively in the EU.
I have been asked to implement a set of new features. Part of this implementation involves making these features inaccessible to users who have not allowed the company to collect additional data. If the user agrees to share this data, they can access the new features. However, these new features do not need to use the additional data in order to work.
I am concerned that this is illegal and am hesitant to carry out the project. I have spent some time trying to research this online but have been unable to find clear advice on the legality of leveraging feature access against data consent options. I do not think this is considered best practice, but I am unable to assess if it is illegal, or just a poor decision.
Is it legal to compel users to share data in order to access more features, when the features being accessed do not require the data being requested?