Under GDPR, consent must be freely given, specific, informed, and unambiguous. This means that pre-ticked boxes and default opt-ins are not allowed. Subscribers must actively opt-in to receive emails, and they must be clearly informed about what they are consenting to. Additionally, businesses must keep records of how and when consent was obtained.