Both the CAN-SPAM Act and GDPR stress the importance of obtaining proper consent. Under GDPR, consent must be freely given, specific, informed, and unambiguous. In other words, you need a clear affirmative action from the recipient, such as checking an unchecked opt-in box. The CAN-SPAM Act also requires that recipients have a clear and conspicuous way to opt-out of receiving further emails.