"Requiring an opt-in might sound more onerous and more likely to protect privacy because the user has to actively provide affirmative consent, but “the fact of the matter is that contracts are usually boilerplate and are hardly ever read by consumers,” said Omer Tene, VP of research and education at the International Association of Privacy Professionals.
“Oftentimes, an opt-in rule yields rote consent and just causes people to sign whatever forms they’re given,” Tene said. “We’ve seen many detailed privacy regulations in the past that didn’t amount to much privacy on the ground at the end of the day. The best of example of that is the European privacy framework, formerly the directive and now the GDPR [General Data Protection Regulation], which is bureaucratic and driven by paperwork.”"