The Information Commissioner's Office have issued some clarity around direct marketing:
Of particular interest is their response on Legitimate Interest
Do I always need consent for marketing and does it have to be opt in or can it be opt out?
No. You won’t need consent for postal marketing but you will need consent for some calls and for texts and emails under PECR. See our Guide to PECR for more on when you need consent for electronic marketing.
If you don’t need consent under PECR you can rely on legitimate interests for marketing activities if you can show how you use people’s data is proportionate, has a minimal privacy impact, and people would not be surprised or likely to object.
If you do rely upon consent it requires a positive opt-in. Don’t use pre-ticked boxes or any other method of default consent. See our consent checklist for more detail.