Soft opt in was fine, and is still fine under GDPR, e.g. a pre-ticked box, as long as the wording was clear, unambiguous etc. so long as we're talking about processing on the basis of Consent (rather that one of the other legal basis's of processing), the ICO disagrees. https://ico.org.uk/for-organ...