Obtaining consent is a fundamental requirement. Under GDPR, you need explicit consent from individuals before sending them marketing emails. This means they must actively opt-in, usually by ticking a checkbox. Under the CAN-SPAM Act, implied consent may be sufficient, but it’s good practice to obtain explicit consent to avoid any legal complications. Always keep a record of when and how consent was obtained.