Under GDPR, consent must be freely given, specific, informed, and unambiguous. This means that pre-ticked boxes, implicit consent, or bundling consent with other terms are not acceptable. Marketers must use clear and plain language to explain what users are agreeing to.