What is the difference between opt-in and opt-out consent, and why is "implied consent" often not legally valid?
Opt-in requires a person to actively agree before processing begins; opt-out assumes agreement unless the person objects. For sensitive processing like call recording, implied/opt-out consent is frequently invalid because consent must be active, informed, and freely given.
The distinction decides whether silence counts as a "yes."
| Model | How it works | Example announcement |
|---|---|---|
| Opt-out (often invalid) | Processing starts automatically; you must act to stop it | "If you do not agree, please hang up." |
| Opt-in (the valid form) | Nothing happens until you actively agree | "Do you agree? Please press 1." |
Why implied consent fails (the German hotline rule): simply continuing a call after a recording notice is konkludente Einwilligung (consent implied by conduct). German supervisory authorities hold this is not sufficient — the caller must actively and voluntarily agree (a keypress or spoken "yes") before recording starts.
The deeper principle: valid consent under GDPR must be a "freely given, specific, informed and unambiguous indication" — and silence, pre-ticked boxes, or "keep using the service" don't meet that bar.
Tip: Pre-ticked checkboxes are the web equivalent of opt-out — the EU Court of Justice (Planet49, 2019) ruled they don't constitute valid consent either.