So is this really only opt-out? If yes, that’s against the GDPR, which requires an active consent:
8 CONSENT OBTAINED UNDER DIRECTIVE 95/46/EC
For example, as the GDPR requires that a controller must be able to demonstrate that valid consent
was obtained, all presumed consents of which no references are kept will automatically be below the
consent standard of the GDPR and will need to be renewed. Likewise as the GDPR requires a
“statement or a clear affirmative action”, all presumed consents that were based on a more implied
form of action by the data subject (e.g. a pre-ticked opt-in box) will also not be apt to the GDPR
standard of consent.
So is this really only opt-out? If yes, that’s against the GDPR, which requires an active consent:
https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202005_consent_en.pdf
That’s great if you live in a region where GDPR applies, and is actually enforced.