[hannnoi]

Hopefully it specifies opt in instead of opt out. I can't tell you how many things I've forgotten to do while being conscientious because it was just so out of the way.

[zaarn]

GDPR wants absolutely undeniable consent including that if you give consent, the corporation involved has to keep proof that you consented. It is very much opt-in.

[rmc]

Yes it's opt-in, and consent also has to be as easy to withdraw (at any time) as it is to give.