I'm not a lawyer, but my interpretation of GDPR and the research I've done suggests that my current lead magnet approach (which is at least in the US very common) gives me consent to use the email for delivering the lead magnet, but not for marketing unless there is an explicit opt in for subsequent marketing emails. I think (and I have read) that not getting the user to explicitly check a box for marketing emails is implicit consent and is not allowed under GDPR. Also, saying something like "you cannot sign up for getting this lead magnet unless you consent to marketing emails" is also not allowed. That said, I agree with you that I'm very clear. So maybe I and others are interpreting GDPR too strictly. Here is one article that takes GDPR very strictly: https://kerstinmartin.com/blog/gdpr-lead-magnets

I just found another article however with another solution which may be better. The article suggests instead of saying "Get this free ebook! And p.s. we will send you information and marketing emails about our product." you should say "Sign up for our newsletter to receive information and marketing emails about our product. Also we will send you a free e-book as a gift." It's not as good of a call-to-action, but changing the order does turn into explicit consent for marketing. Source: https://blog.mailrelay.com/en/2017/12/28/new-gdpr#_What_abou...