They link to the actual legislation at the foot of the page, noting the relevant sections. GDPR is very readable, and pretty concise. They also link to two more in depth explorations of consent. Bear in mind the ICO are the UK's enforcement body, so are presenting an accurate picture of the law. To quote three relevant points from the linked page:

The GDPR is clearer that an indication of consent must be unambiguous and involve a clear affirmative action (an opt-in). It specifically bans pre-ticked opt-in boxes. It also requires distinct (‘granular’) consent options for distinct processing operations. Consent should be separate from other terms and conditions and should not generally be a precondition of signing up to a service.

The GDPR gives a specific right to withdraw consent. You need to tell people about their right to withdraw, and offer them easy ways to withdraw consent at any time.

If you make consent a precondition of a service, it is unlikely to be the most appropriate lawful basis.

So yes it's law, unless and until someone manages to appeal some interpretation of a point all the way up the chain.