Don't get me wrong--I'd much prefer opt-in. I don't think that's realistic though given their leverage and what they are trying (in theory) to do with this data.
However to not provide an opt-out is a slap in the face to those who know enough to care. And it is an increasingly common trend that is very concerning.
Rather: by requiring the user to opt in.