Greg Sterling:

Article 7 (3) of the GDPR requires that an opt-in must be as easy to undo as it was to give in the first place, and that people can do so without detriment.