Relevant to GDPR article 7 (1) is Recital 32:
Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject's acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject's consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.
Important is that consent was actively given and to all purposes. A checkbox can already be enough, although not a pre-ticked one.
The ICO gives examples in How should we obtain, record and manage consent? on how to record consent, in accordance with GDPR article 7 (1):
You keep a copy of the customer’s signed and dated form that shows they ticked to provide their consent to the specific processing.
You keep records that include an ID and the data submitted online together with a timestamp. You also keep a copy of the version of the data-capture form and any other relevant documents in use at that date.
You keep records that include the time and date of the conversation, the name and date/version of the script used.
These are ways to keep an audit trail in case you are getting challenged.
Piotr Foitzik of the IAPP writes in How to verify identity of data subjects for DSARs under the GDPR:
This means that you also should consider how sensitive the data is and what are the risks. The more sensitive the data, the more effort to authenticate is expected. This is in accordance with the risk-based approach, and you can justify asking for more information or more critical or sensitive information if you do this to protect the data subjects against possible risks to their rights and freedoms.
The whole article is worth reading, but the above quote is possibly the most relevant to your question. You are concerned about imposters. How do you know that some John Smith who consented is actually John Smith and not someone else?
First of all, keep in mind the principle of data minimisation (GDPR article 5 (1.c)). This is important when you collect data in the first place, but also when you want authenticate data subjects.
As you noticed, the GDPR is doesn't got that much into detail about how consent is to be given. The reason is that the method depends on the collected data. The more sensitive, the more you need to make sure the data subject consenting is actually the data subject they claim to be. On a site users can use basically anonymously, e. g. just a pseudonym and a throw-away email address, a check box may well be enough. If you want to collect more sensitive data, you need more. But this is rather broad and depends too much on the data etc. But you'd probably have to show that you undertook reasonable effort (borrowed from GDPR article 8 (1) on child's consent) to verify the data subject's identity. But what is reasonable again depends.
