Opt In

Opt-in is the default consent standard under GDPR, DPDP, PDPA and UAE PDPL. Consent must be given through a clear affirmative act; silence, pre-ticked boxes and inactivity do not constitute consent (GDPR Recital 32). Each processing purpose generally needs its own opt-in — bundled consent for 'improving our services, marketing, analytics and partners' fails the Article 7 and DPDP Section 6 specificity tests. Opt-in records should capture the subject identifier, timestamp, purpose, notice version shown, and the source channel.

Most US state privacy laws instead rely on an opt-out baseline for standard processing but switch to opt-in for sale/share of personal information where the consumer is a known minor, for processing of sensitive personal information (CPRA), and for all processing under laws such as the Vermont and Oregon kids-data regimes. Where multiple regimes apply, the stricter standard controls — for a user who is both a California resident and a Union resident, opt-in applies.