Under GDPR, consent must be freely given, specific, informed, and unambiguous. This means you cannot use pre-ticked boxes or assume consent from silence. You need to clearly explain why you are collecting the data and how it will be used. This is particularly important when building your email list.