What is the difference between opt-in and opt-out consent, and which one is legally valid in the EU?
Opt-in requires the user to actively agree before data processing begins. Opt-out assumes consent unless the user objects. Only opt-in is legally valid in the EU.
The EU Court of Justice (EuGH) ruled in the Planet49 case (October 1, 2019) that the only valid form of consent for processing user data in the EU is explicit opt-in, meaning a specific declaration of consent that the user actively and specifically grants, for example by checking a box.
Consent requirements under EU law:
- Must be given unambiguously.
- Must involve a positive action by the individual.
- The person must understand what they're consenting to.
- The person must understand what they're agreeing to share.
Opt-in vs. Opt-out:
| Approach | How it works | EU legal status |
|---|---|---|
| Opt-in | User must actively check a box or click to agree | Valid. Required by GDPR. |
| Opt-out | Consent is assumed unless the user actively objects | Not valid in the EU for data consent. |
Technical implementations of opt-in:
- Clicking a specific icon or button.
- Checking an unchecked checkbox.
- Subscribing to a service.
- Sending a confirmation email.
Important: Pre-checked boxes do NOT count as valid consent. The user must perform a deliberate action. This is why cookie banners in the EU must present "Accept" and "Reject" as equally accessible options.