[dspillett]

I am not missing your point. I am asserting that your point is incorrect. Show me where in a law/regulation where anything like that is stipulated.

IIRC all that is stipulated in the EU regs, for instance, WRT cookies and other tracking tech is the ability to opt-out should be as easy as the ability to opt in, it should not be auto-opt-in, you can opt-out later if you do opt-in, and you should be properly informed about what you are opting into.

The bad UX patterns making it time-consuming, confusing, or otherwise unpleasant, to opt-out are actually against the spirit of the law (perhaps even the letter of the law) but unfortunately it is not proving really practical to enforce.