When double opt-in is enabled and a new Contact subscribes, they receive an email asking them to confirm their subscription, however before they have clicked on the confirmation, their contact details are already stored in Dynamics. This doesn't seem to comply with GDPR as they may change their mind and not confirm the email yet the Contact record has been created and their data is still being stored.

The Contact record should only really be created in Dynamics after they have clicked on the link in the email to confirm their subscription.