Under the GDPR explicit conset is required, implicit consent is no longer sufficient. End of story.

As the operator of the website it becomes your duty to properly inform the user of what you are doing with their data and why.