Under GDPR, obtaining explicit consent is crucial. Consent must be freely given, specific, informed, and unambiguous. This means that individuals must actively opt-in to receive emails, and pre-checked boxes or passive opt-ins are not compliant. Businesses must also keep records of how and when consent was given.