Yes, consent must be given, and it should be a positive action. Inaction, pre-checked boxes does not qualify.