[matsemann]

Gdpr article 7 says it should be as easy to withdraw consent as to give it.

The rules are pretty straightforward, really, it's just Google banking on the fines for not doing it correctly would be less than the profit made.

[NelsonMinar]

Article 7 is pretty non-specific and does not discuss defaults. Recital 32, however, is quite specific and gives me the answer I was looking for https://gdpr.eu/recital-32-conditions-for-consent/

"Consent should be given by a clear affirmative act ... Silence, pre-ticked boxes or inactivity should not therefore constitute consent."