Data subjects must deliberately opt in when consent is required by GDPR. The ways a data subject can provide lawful consent include:
Signing a consent statement on a paper form
Clicking an opt-in button or link online Selecting from a yes/no option
Answering yes to a clear oral consent request
Choosing technical settings that demonstrate consent