I am not sure where you are, but this is usually standard. You can’t film someone at a place where there’s some expected form of privacy and use that footage publicly.

Talking about GDPR, the fact they had to ask is proof it works. It’s an opt in. Your friend now has the option to say yes if they want to share it, but the default is no.

There are also provisions for withdrawing consent after giving it. The agreement can’t go above that law.