Note to publishers: The burden of proof in terms of GDPR is with the ‘data controller’ (that’s you), not your data processor (like the service you use for email newsletter). So, you can get consent via your own forms on your own site and that’s perfectly fine. /1
What I mean is that I see many publishers who feel they are forced to redesign and reaquire all the email subscribers because their newsletter service says so. This is not a GDPR requirement. You are the data controller, they are the data processor. /2
The only thing you really have to do as the ‘data controller’ is to make sure that all your data processors are GDPR compliant and not using any of the data outside the scope of what people signed up for (which must be limited and specific) /3
As long as this is in place, and that everyone on your list signed up voluntarily, and that you newsletter is specific, everything is fine. /4
See also: theguardian.com/technology/201…
Example: When people sign up for Baekdal Plus, I ask them if you also want to get the newsletter. This is *fully* GDPR compliant. And when I then manually add them to my newsletter list (on MailChimp) it's still 100% GDPR compliant even though I'm not using MailChimp's forms. 
Article 7 (1):
“Where processing is based on the data subject’s consent, the controller should be able to demonstrate that the data subject has given consent to the processing operation.”
It's the 'Controller' (me) who should be able to demonstrate consent, not Mailchimp.
“Where processing is based on the data subject’s consent, the controller should be able to demonstrate that the data subject has given consent to the processing operation.”
It's the 'Controller' (me) who should be able to demonstrate consent, not Mailchimp.
So when MailChimp is now telling everyone to delete their lists and start over with their 'GDPR compliant forms', this is not a legal requirement from a GDPR perspective. MailChimp is not the data controller.
Another important thing. There is nothing in GDPR that dictates that newsletter signup forms *must have a checkbox* on them. What it actually says is this:
This means that, if you have a form that is explicitly about that one newsletter you send out, the signup form itself (people entering their email) is enough to define consent. You don't have to also add a checkbox to ask for consent again.
The only reason why the checkbox comes into question is because a lot of sites do other things when they also want people to get the newsletter. For instance, you might have a web shop checkout form, where you also want people to get the newsletter. [cont]
In that case, you need additional affirmative action for the newsletter, like a checkbox that people have to click. So, you only need an extra checkbox that people have to click if the main form is for something else so that the newsletter is an extra action.
But right now we see a lot of newsletter services (like MailChimp) saying: "Oh you really need redesign your forms so that you have both the email signup and the extra checkbox". No... you don't. There is nothing in GDPR that dictates this.
