How do firms ask for consumers’ data permission? And how do customers react