The GDPR demands clear, active consent for data collection and processing. This is a change from the old "opt-out" method. Users must agree to data collection and can withdraw consent anytime.