Consent under GDPR must be freely given, specific, informed, and unambiguous. This means users must take a deliberate action to opt in and that pre-ticked boxes or inactivity does not constitute consent. You must also provide a clear and straightforward way for individuals to withdraw consent.