You may wish to consult your privacy attorneys; you'll likely be the subject of a number of GDPR complaints considering the above.
My interpretation of the above if you were to do it within the letter of the law (again, talk to your attorneys; I'm just a security director):
1. opt-in via settings page (or a modal on next login) for all people who already have accounts.
2. opt-in during registration for all people who choose to register accounts after the roll-over date.
Again, talk to your attorneys. If you successfully roll over without having taken the suggestion to talk to your attorneys, your conversation with your attorneys may change from "how to best implement this" to "how to avoid getting fined."