Opt-in vs opt-out: the difference, with examples and GDPR rules

What do opt-in and opt-out mean?

Opt-in means the person takes a positive step to say yes. Until they do, the answer is no. Ticking an empty newsletter box, clicking "Accept" on a cookie banner or confirming a subscription by email are all opt-in actions.

Opt-out means the answer is yes by default. The processing runs from the start, and the person can say no later: by clicking "unsubscribe", unticking a pre-ticked box or using a "Do Not Sell or Share My Personal Information" link.

The two terms are used well beyond privacy (organ donation, pension schemes, phone directories), but the logic is always the same. The only thing that changes is who has to act, and when. With opt-in, the organisation must obtain a yes. With opt-out, the individual must express a no.

The difference between opt-in and opt-out consent, with examples

The easiest way to see the difference is to compare the same situation under both models:

• Cookie banner. Opt-in: Google Analytics loads only after the visitor clicks "Accept". Opt-out: Google Analytics loads on arrival, and the banner offers a way to refuse afterwards.
• Newsletter at checkout. Opt-in: an empty box "Send me your newsletter". Opt-out: the same box already ticked, or a sentence saying "you will receive our newsletter unless you uncheck this box".
• Data sale in California. Opt-out: a business may sell or share personal data until the consumer clicks "Do Not Sell or Share My Personal Information" or sends a Global Privacy Control signal.
• SMS marketing in the US. Opt-in: the person texts a keyword or signs a form before receiving promotional texts.

A pre-ticked box is the most common trap. It looks like a choice, but the person who does nothing is treated as having agreed. Legally, it is opt-out.

Opt-in vs opt-out under the GDPR

The GDPR does not use the words "opt-in" or "opt-out", but its definition of consent is opt-in by design. Article 4(11) of the GDPR requires "a statement or a clear affirmative action", and Recital 32 states that "silence, pre-ticked boxes or inactivity" do not constitute consent. The full list of conditions is in our guide to the 7 requirements for valid GDPR consent.

Two rulings and guidelines make this concrete:

• Planet49 (CJEU, 1 October 2019, C-673/17). The Court of Justice held that a pre-ticked checkbox does not produce valid consent for cookies, whether or not the cookies contain personal data.
• CNIL guidelines and recommendation (September 2020). The French authority stated that continuing to browse is not consent and that refusing must be as easy as accepting. Its later sanctions against large platforms targeted banners where refusing took more clicks than accepting.

Opt-out still has a place in the GDPR, but not as consent. When processing relies on legitimate interest, people have a right to object (Article 21), which works like an opt-out. For direct marketing, that right is absolute: once someone objects, you stop. Withdrawing consent must also be as easy as giving it (Article 7(3)), so an opt-in always comes with a simple way back out.

For the wider picture of consent forms (explicit, implied, informed), see types of consent explained.

Opt-in vs opt-out for cookies

For cookies, the rule comes from Article 5(3) of the ePrivacy Directive: storing or reading information on a device requires prior consent, unless it is strictly necessary for the service the user asked for. In practice:

• Opt-in is required for analytics, advertising, social media pixels, A/B testing tools and most embedded content.
• No consent is needed for strictly necessary cookies, such as a session cookie for a shopping cart or the cookie that stores the consent choice itself.

"Prior" is the important word. If a tag fires before the click, the banner is opt-out in practice, whatever its buttons say. That is the most frequent problem found in audits: the banner looks compliant, but Google Analytics or the Meta Pixel has already set its cookies.

Check in 30 seconds which cookies your site sets before any choice with the free cookie scanner. If cookies other than the strictly necessary ones appear before consent, your banner is working as an opt-out.

The UK follows the same opt-in rule for cookies under PECR, enforced by the ICO (see UK GDPR and PECR).

Opt-in vs opt-out in email marketing

Email marketing follows a slightly different rule. Article 13 of the ePrivacy Directive requires prior consent for marketing emails to individuals, with one exception, often called soft opt-in: a business may email its existing customers about similar products and services, as long as it offered a way to refuse when collecting the address and in every message.

National rules vary on the details:

• France: article L34-5 of the French Postal and Electronic Communications Code applies opt-in to consumers. For professionals, the CNIL accepts opt-out, provided the message relates to the recipient's job and they were informed and could object.
• Germany: § 7 UWG requires prior express consent for advertising emails, with an existing-customer exception in § 7(3). Double opt-in (a confirmation email before the first newsletter) is standard practice because it proves the consent.
• Spain: article 21 of the LSSI prohibits commercial emails without prior request or express authorisation, with a similar exception for existing customers.
• UK: regulation 22 of PECR sets the soft opt-in for existing customers.

Double opt-in is not required by the GDPR text, but it answers Article 7(1): you must be able to demonstrate consent. The same logic applies to cookies, where you keep a record of each choice (see what to store as proof of cookie consent).

Opt-out countries: the United States

Most US privacy laws are opt-out by default. Under the CCPA, as amended by the CPRA, businesses can collect data and set cookies without prior consent, but they must let consumers opt out of the sale or sharing of their personal information and honour opt-out preference signals such as Global Privacy Control. In 2022, the California Attorney General settled with Sephora for $1.2 million, partly for failing to process GPC signals. Our CCPA vs GDPR comparison and the CCPA and CPRA page cover the details.

Opt-in still exists in US law:

• the CCPA requires opt-in before selling or sharing the data of consumers under 16 (parental consent under 13);
• several state laws require opt-in for sensitive data, such as health or precise geolocation;
• the TCPA requires prior express written consent for marketing texts and automated calls.

For email, CAN-SPAM is opt-out: marketing emails are allowed, but every message needs a working unsubscribe link, and requests must be honoured within 10 business days.

Is opt-in or opt-out better?

For the person, opt-in gives more control: nothing happens without a decision. For the business, opt-out produces more data, because most people never change a default. That is precisely why European law chose opt-in for cookies and marketing: a default is not a choice.

Opt-in has practical advantages too. Consent you can prove protects you during an audit or a complaint. A mailing list built on opt-in has fewer spam complaints. And a single opt-in model is the simplest way to serve visitors from several countries: it meets the European standard and is also accepted where opt-out is the norm.

FlowConsent is one example of this approach: the banner applies opt-in to every visitor, with "Accept" and "Reject" given equal weight on the first layer.

Opt-in consent checklist for your website

1. Block every non-essential cookie and tag until the visitor clicks.
2. Show "Accept" and "Reject" at the same level, with the same visual weight.
3. Never pre-tick a box, for cookies or newsletters.
4. Let visitors choose by category (analytics, marketing, preferences).
5. Keep a way to change or withdraw consent at any time, such as a floating button.
6. Record each choice with a date, the banner version and the categories accepted.
7. Send denied default signals to Google tags until consent is given.
8. Re-scan your site after each new tool or plugin.

How FlowConsent handles opt-in consent

FlowConsent applies the opt-in model by default. Scripts that need consent are blocked before consent, so nothing fires until the visitor clicks "Accept" or chooses categories. Google Consent Mode v2 is built in: all four signals start as denied before any Google tag loads, then switch to granted only after an opt-in (see the Google Consent Mode documentation). The automatic cookie scan lists the services your site loads, and every choice is recorded, so you can export proof of consent at any time. Data is hosted in Europe and installation takes about ten minutes, on Webflow, WordPress, Shopify, Wix, Framer or through GTM. FlowConsent is free up to 25,000 sessions per month, then Pro costs €14.99 per month for up to 100,000 sessions.