A few things are important... 1. That checkbox could not have been checked by default. If it was, the consent wasn't valid, and they can't contact you. 2. Con

A few things are important... 1. That checkbox could not have been checked by default. If it was, the consent wasn't valid, and they can't contact you. 2. Consent can't be grouped together. If there was a single checkbox for subscribing to special offers, and news about site updates, that is not valid. There needed to be separate checkboxes for each of those items. 3. They need to be able to prove you gave consent. For example, by knowing when you gave consent, where you gave consent, and how it was presented to you. In the past they might have just updated a "subscribed" flag on your account from 0 to 1 when you checked the box on the registration page, or when you went to your account settings and signed up for the newsletter. That's not valid because they can't prove where you gave consent. Did a user click a link in an email 4 years ago to subscribe to the newsletter? If so, can they demonstrate what that email said, along with the actions taken, to prove that valid consent was received? This is some of the reasons why companies are asking for consent again. They might have done their best to properly receive consent in the past, but now the email list they spent years building is invalid.