GDPR consent is typically collected by the publisher running Brand Stories on site level. That generally implies consent is given for all content and third parties allowed to run. Some eser added trackers/embeds/attachments may require GDPR consent. This can be gathered by including your own CMP in the story code.