Under GDPR, organisations have a few ways in which they can legally contact a person or share their data. One of those ways is consent. This means that the recipient has explicitly agreed to the organisation contacting them or to have their data shared.
Unlike previous regulations, the fine print within GDPR means that websites can no longer pre-tick “I agree to receive email” tickboxes.