If your site uses anything beyond strictly necessary cookies, yes, and consent must be opt in.
If your website sets cookies that are not strictly necessary for it to function, you need consent before they are set. Analytics, advertising, embedded video and social media widgets all fall on the wrong side of that line.
Consent has to be a positive action. A pre ticked box is not consent, and neither is a banner that says "by continuing to browse you agree". Refusing must be as easy as accepting, which means a reject button of equal prominence, not a link buried in a settings panel.
You also have to keep evidence of what each visitor chose, and let them change their mind later.
Priva generates a banner you paste into your site, records every decision with a timestamp, and keeps the log in a form you can hand to the Commissioner.