Most of the rules in GDPR apply only to personally-identifiable information that is not strictly required for business operations. The law recognizes that, when you want to ship some goods to a customer, you will have to process and store their address, and no opt-in is needed because the customer explicitly gives that information to you.

Explicit opt-ins are only required when you record personally-identifiable information surreptitiously, or share these information with other parties.