Under the GDPR, consent must be freely given, specific, informed, and unambiguous. This means individuals must be fully aware of what they are agreeing to and must take a clear affirmative action to give their consent. The CAN-SPAM Act, on the other hand, does not require prior consent but mandates that marketers clearly identify their messages as advertisements and provide a way to opt-out.