Even without GPDR single opt-in is already insufficient in e.g. Germany. If you send a newsletter to some lawyer and can't prove consent you might just get a C&D with statutory damages back.