[jkaplowitz]

The GDPR doesn’t allow opt-out consent to count as consent. The only consent it recognizes as valid consent is opt-in.

However, since we are discussing the banner that The Guardian website shows to US viewers, I assume they’re trying to comply with California privacy law, which does allow opt-out regarding the sale of personal information.

[troupo]

> The GDPR doesn’t allow opt-out consent to count as consent.

wat

GDPR says that opt-out is the default, and if you are asking for consent, it had to be clear, unambiguous, and with both chouces clearly present.

[inigyou]

You're both using different meanings of "opt-out"

Not legal: you have to click a button to be opted out, otherwise you're opted in. (Opt-out as a verb)

Legal: you are opted out by default (opt-out as an adjective describing the default situation)

[ButlerianJihad]

https://en.wiktionary.org/wiki/opt-out

https://en.wiktionary.org/wiki/opt-in

You've muddled the definitions again. "opt" signifies an action by the user.

If I am "in a group" by default, then I can take an action to "opt out", requesting to be removed from the list.

If I am not initially joined to the group, then I can take an action to "opt in" and be added to the list.

There is no such thing as "opt by default". That is not a user action. It also makes no sense for the same list or group to be both "opt in" and "opt out" because, as adjectives, they imply the default states and they describe the user action taken to change that default.

opt-in: default state is out

opt-out: default state is in

[inigyou]

>> The GDPR doesn’t allow opt-out consent to count as consent.

> GDPR says that opt-out is the default

do you see how these relate? The second one quite explicitly talks about being opted out by default, i.e. what most of us call opt-in.