Opt-in

Opt-in translates roughly as “actively choosing to do something”. It refers to a rule: something may only happen once you have expressly agreed to it beforehand. As long as you say nothing, that counts as a no. The opposite is called opt-out. There, the thing happens automatically, and you have to take action yourself to stop it. The difference sounds small, but it decides who has to do the work: the company or you.

Why the default setting matters so much

People rarely change default settings. That’s not just a claim — it’s well studied. With opt-out solutions, often more than 90 percent of users stick with whatever is set by default. Whoever sets the default effectively determines the behavior of almost everyone involved.

That’s exactly why companies and data protection advocates fight so hard over this. For a company, an opt-in usually means significantly fewer consents. For users, on the other hand, it means that no one uses their data without asking. European data protection law deliberately relies on opt-in for sensitive matters.

Right now, this is being discussed mainly in the context of artificial intelligence. Several social networks have announced that they will use their users' public posts to train their systems. Usually as opt-out: if you don’t want this, you have to object. Critics are calling for opt-in instead, because hardly anyone actually reads such announcements.

From checkbox to confirmation email

Technically, an opt-in is often just a box to click. What matters is that it must not be pre-checked. A pre-ticked checkbox is not legally an opt-in, but a hidden opt-out. The European Court of Justice explicitly established this in a well-known 2019 ruling.

For newsletters, there’s a stricter variant: double opt-in. After signing up, you first receive an email with a confirmation link. Only once you click that link are you actually registered. This way, no one can sign you up using your address without your knowledge.

A valid consent must also meet three conditions. It must be given voluntarily, it must relate to a clearly stated purpose, and it must be revocable at any time. A blanket “I agree to everything” is therefore not enough. And withdrawing consent must be just as easy as giving it.

Cookie banners, privacy policies, AI training

You most commonly encounter opt-in in cookie banners. Analytics and advertising cookies — small files that record your behavior on a site — require your consent. Technically necessary cookies for the shopping cart, on the other hand, do not. That’s why some toggles in the banner are switched on by default and others aren’t.

In products, opt-in also shows up with trial features. New AI functions in phones or office programs often only run once you deliberately turn them on. The question of whether your chat histories may be used to improve a language model is also, in many services, such a toggle in the settings.

In business news, the term plays a special role of its own. When a provider switches from opt-out to opt-in, its data base often collapses. When Apple made app-based tracking subject to consent in 2021, this reportedly cost Meta around ten billion dollars in revenue per year, according to the company itself. A single word in a default setting can thus move billions of dollars.