This is how GDPR works, explicit opt-in consent is needed from the customer.

https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re...