Obtaining consent under GDPR requires a clear and affirmative action from the user. This means no pre-ticked boxes or passive agreement. Consent must be freely given, specific, informed, and unambiguous. You should provide a [privacy policy]() explaining how personal data will be used and offer an easy way for users to withdraw consent at any time.