[vorpalhex]

Usually you'd save the users opt in time, and tie it back to their user account. You would need to make sure the opt in clearly explains what it's for. You would also save the context of the opt in - was it during account registration, when they visited a blog post, etc.

Obviously make sure to otherwise comply with the GDPR as you do this.