Opt-in requires a positive choice before a consent-based activity starts. Opt-out provides a way to stop an activity that may lawfully proceed without that consent. Neither label is a lawful basis by itself. Check the GDPR basis, any condition for special-category data or automated decisions, and the applicable national electronic-marketing rules before choosing the default.
Opt-in vs opt-out at a glance
| Opt-in | Opt-out | |
|---|---|---|
| Default state | Processing off | Processing on |
| Who acts first | The individual (to allow) | The individual (to stop) |
| Typical lawful basis | Consent — Art. 6(1)(a), Art. 9(2)(a) | Legitimate interest — Art. 6(1)(f) |
| Valid signal | Clear affirmative act: ticking, clicking, selecting | Objection under Art. 21, unsubscribe link |
| Invalid signal | Silence, pre-ticked box, inactivity, continued browsing (Recital 32) | Requiring a phone call or postal letter to unsubscribe |
| Typical uses, subject to applicable rules | Consent-based subscriptions and trackers that require consent | Objection to direct marketing or a properly assessed legitimate-interest activity |
| Burden of proof | Controller must prove consent was given (Art. 7(1)) | Controller must prove the balancing test was done |
| Cost of getting it wrong | Processing has no lawful basis from day one | Objection ignored — separate Art. 21 breach |
The practical question is whether the activity is allowed to begin before the person acts. Review the purpose, channel, recipient and country together; an unsubscribe link cannot repair the absence of required prior consent.
Definitions: Opt-In and Opt-Out
Opt-in means the individual must take an affirmative action before processing begins. The specific consent-based activity does not start until the person agrees; other necessary operations may rely on a different lawful basis. Under GDPR, this takes the form of a clear affirmative act — ticking an unchecked box, clicking a dedicated consent button, or selecting specific preferences. Silence, pre-ticked boxes, and inactivity do not constitute consent (Recital 32).
Opt-out means processing proceeds by default, and the individual can object or withdraw at a later point. The right to opt out is typically associated with processing based on legitimate interest (Article 6(1)(f)) or direct marketing (Article 21(2)), where the data subject has a right to object rather than a right to give prior consent.
The distinction is not merely procedural. It determines who bears the burden of action: in opt-in, the controller must obtain consent before processing; in opt-out, the data subject must take steps to stop processing that is already underway.
Three refinements matter once you move from the definition to an implementation.
Double opt-in can strengthen evidence, but it is not the only possible evidence. A confirmation step helps establish control of an email address. Keep the purpose, notice version, affirmative action and timestamp as well. GDPR Article 7(1) requires demonstrable consent without prescribing double opt-in as a universal method. Evaluate the applicable national rules and the risk of false subscriptions.
Opt-out is not the same as withdrawal of consent. Withdrawing consent (Art. 7(3)) ends a processing operation that was based on consent. Objecting (Art. 21) challenges processing based on legitimate interest, and the controller may in principle continue if it demonstrates compelling legitimate grounds that override the individual’s interests — except for direct marketing, where Article 21(3) makes the objection absolute and immediate. Conflating the two produces unsubscribe flows that ask the user to justify themselves, which is unlawful for marketing.
A global default needs a country and channel check. An opt-out interface designed for another jurisdiction does not determine the EU lawful basis or satisfy consent requirements. Maintain separate decisions for cookies, email, calls and other processing rather than treating a global preference switch as permission for every use.
When GDPR Requires Opt-In
When consent is the applicable basis or a sectoral rule requires it, the choice must precede that activity. Distinguish the following cases:
Cookies and tracking technologies. The ePrivacy Directive (Directive 2002/58/EC, Article 5(3)) requires prior consent before placing non-essential cookies or similar trackers on a user’s device. This is an opt-in requirement implemented across the EU. The CJEU confirmed in Planet49 (C-673/17, 2019) that pre-ticked boxes do not satisfy this requirement. Do not treat a proposal to change the rules as an enacted exemption; verify the rules applicable when the service operates.
Email marketing to individuals. Under the ePrivacy Directive (Article 13), sending marketing emails to individuals requires prior consent — opt-in. The existing-customer exception and the treatment of professional recipients depend on the applicable rules. Identify the recipient and jurisdiction before applying a consumer-email default.
Processing of special categories of data. Health data, biometric data, political opinions, trade union membership, and other categories listed in Article 9 require explicit consent under Article 9(2)(a) unless another exception applies. “Explicit” is a higher bar than standard consent — it demands an unambiguous, specific statement of agreement.
Automated decision-making and profiling. Where processing involves solely automated decisions that produce legal or similarly significant effects (Article 22), explicit consent is one of the limited lawful bases available.
Cross-border data transfers to inadequate countries. When no adequacy decision or appropriate safeguards exist, explicit consent under Article 49(1)(a) can serve as a derogation — but only if the individual is informed of the risks and consents specifically.
When Opt-Out Is Permissible
Opt-out mechanisms are appropriate when processing relies on a lawful basis other than consent:
Legitimate interest (Article 6(1)(f)). When the controller has conducted a legitimate interest assessment and concluded that the processing is necessary and does not override the data subject’s rights, opt-out is the correct model. The data subject has the right to object under Article 21(1), and the controller must cease processing unless it demonstrates compelling legitimate grounds.
Direct marketing to existing customers (“soft opt-in”). Article 13(2) of the ePrivacy Directive allows electronic marketing to existing customers who provided their email during a sale, provided the marketing relates to similar products and each message includes an easy opt-out. Check every condition, including the opportunity to object when the details are collected and in each message. National rules for professional recipients also require separate analysis.
Postal direct mail. In most EU jurisdictions, physical mailings can be sent on a legitimate interest basis with an opt-out mechanism. The triple test (purpose, necessity, balancing) must still be satisfied.
Analytics. Separate the processing basis from any requirement for storing or accessing information on a device. Legitimate interest under GDPR does not override a consent requirement under national ePrivacy rules. An exemption for a narrowly configured measurement tool must be verified against its actual configuration and the applicable guidance.
Practical Examples
Email Marketing
| Scenario | Model | Legal Basis | Implementation |
|---|---|---|---|
| New subscriber, never purchased | Opt-in | Consent (Art. 6(1)(a)) | Unchecked checkbox at signup: “Yes, send me the weekly newsletter.” Double opt-in recommended. |
| Existing customer, similar products | Opt-out (soft opt-in) | Legitimate interest + ePrivacy Art. 13(2) | Details collected in the sale context; a simple free objection offered at collection and in every message; same trader and similar products or services. |
| Third-party list | Opt-in | Consent obtained by the list provider must be specific to your use | Verify that the provider obtained consent naming your organization and purpose. |
Cookie Consent
Opt-in is the default for all non-essential cookies. The implementation must provide:
- An “Accept All” and “Reject All” button of equal visual prominence
- Granular category selection (analytics, marketing, functional)
- No cookie wall (making site access conditional on accepting all cookies — the EDPB has stated this is generally not valid consent)
- Consent stored and retrievable for audit purposes
The CNIL’s 2020 cookie guidelines and its subsequent enforcement wave (including the EUR 150 million fine against Google and EUR 60 million fine against Facebook in January 2022) established that a “Continue browsing” action does not constitute valid consent. Only a clear affirmative click on a dedicated acceptance button qualifies.
Data Sharing with Third Parties
Determine the lawful basis and roles for the particular disclosure; third-party sharing does not universally require consent. Where consent is required, it must be specific and informed, including the relevant recipients and purposes. A general reference to unnamed partners cannot be assumed to authorize a separate marketing use.
Phone marketing and national rules
Separate live calls, automated calls and electronic messages. Their rules vary by jurisdiction, audience and purpose. In France, since 11 August 2026, consumer telephone marketing requires prior consent unless an applicable exception, including the conditions for a current contract, applies. A Bloctel check alone is no longer a sufficient general basis for a new consumer campaign. CNIL explanation.
Country-specific decision record
For each market, record the recipient category, channel, source of the contact details, rule relied on, information provided and method for stopping further use. Review national changes before launching a campaign; a previous campaign’s approval does not cover a changed channel or audience.
France illustrates why these distinctions matter. The CNIL’s email guidance distinguishes consumer consent, the existing-customer exception and professional prospecting related to the person’s profession, with information and a simple free objection. That French B2B approach must not be exported automatically to every EU country.
Hypothetical example. A software supplier receives an employee’s request for a technical demonstration. Answering that request and subscribing the person to recurring campaigns are separate operations. The team documents the campaign’s audience and jurisdiction, checks the applicable conditions and keeps the source of the contact. When the person objects to direct marketing, it stops that use across its campaign provider and saved lists, while separately evaluating any data still required for the requested service.
The implementation check is operational: a contact imported again must not silently lose its objection status. Keep a minimal, justified suppression record and inspect queued messages as well as the main profile. For consent-based subscriptions, preserve the notice and choice history without reusing it as an active marketing list.
Common Mistakes
Treating opt-out as a universal fallback. Some organizations default to opt-out for all processing, assuming they can rely on legitimate interest. But legitimate interest requires a documented assessment, and it does not override separate Article 9 conditions, Article 22 safeguards or a national requirement for prior marketing or tracker consent. The bill for getting this wrong in outbound marketing is concrete: see what non-compliant prospecting costs, a €500,000 CNIL sanction that wiped out a company’s annual profit.
Missing the withdrawal mechanism. Article 7(3) requires that withdrawing consent must be as easy as giving it. If subscribing takes one click but unsubscribing requires navigating three pages and confirming via email, the consent is defective.
Confusing consent with contract. Accepting terms of service is not the same as giving consent for data processing. Bundling consent with contractual acceptance violates the “freely given” requirement. If refusing consent means the user cannot use the service — and the processing is not necessary for the service — the consent is not valid (Article 7(4)).
Ignoring the “soft opt-in” conditions. The soft opt-in exception is narrowly defined: it applies only to existing customers, only to similar products or services, only when the email was collected in the context of a sale, and only if each message includes an easy opt-out. Marketing a new product line to old customers may not qualify.
FAQ
What does opt-in mean?
Opt-in means the individual has to take a positive action before you may process their data — ticking an unticked box, clicking a dedicated button, selecting a preference. Until they do, nothing happens. Recital 32 GDPR is explicit that silence, pre-ticked boxes and inactivity are not opt-in. Under Article 7(1) you must also be able to demonstrate afterwards that the person opted in, which is why double opt-in is the practical standard for email.
What does opt-out mean?
Opt-out means the processing is already running and the individual can stop it. In EU law the mechanism is the right to object under Article 21: for processing based on legitimate interest, the controller must stop unless it can demonstrate compelling legitimate grounds; for direct marketing, Article 21(3) makes the objection absolute — you stop, with no balancing and no delay. An unsubscribe link is the everyday form of an opt-out.
Is opt-out legal under GDPR?
Yes, but only where the lawful basis is something other than consent. Opt-out is lawful for processing based on legitimate interest supported by a documented balancing test, for postal direct mail in most member states, and for email to existing customers under the ePrivacy “soft opt-in”. It cannot replace consent where consent is required. Special-category data and significant automated decisions require their own analysis: consent is one possible route, not the only exception provided by Articles 9 and 22.
When does GDPR require opt-in rather than opt-out?
GDPR requires opt-in (consent) when there is no other applicable lawful basis. Check tracker and marketing requirements under applicable ePrivacy rules separately. Articles 9 and 22 include several conditions or exceptions; they do not require consent in every case. Whenever consent is the lawful basis, it must be obtained before processing begins — not after.
Can I use opt-out for email marketing?
Only where the applicable rules allow the campaign without prior consent. The existing-customer exception has cumulative conditions, including a simple free objection at collection and in each message. Professional-recipient rules vary: the French CNIL guidance is an example, not a universal EU rule. An unsubscribe mechanism never supplies a missing lawful basis.
What is the difference between consent and legitimate interest in practice?
Consent (Article 6(1)(a)) requires the individual to affirmatively agree before processing starts — opt-in. Legitimate interest (Article 6(1)(f)) allows processing without prior agreement, but the individual has a right to object — opt-out. The controller must document a legitimate interest assessment showing that the processing is necessary, proportionate, and does not override the individual’s rights. If the balancing test fails, that legitimate-interest justification cannot be used. Reassess or redesign the activity; consent is not automatically available or valid simply because another basis failed.
Are cookie walls (blocking site access until consent is given) legal under GDPR?
The EDPB’s Guidelines 05/2020 on consent state that cookie walls generally do not constitute valid consent because they make site access conditional on accepting all cookies, undermining the “freely given” requirement. Some DPAs, including the French CNIL, have taken a nuanced position allowing cookie walls only where a genuine equivalent alternative (such as a paid subscription) is offered. In practice, the safest approach is to allow full site access regardless of cookie choices, using only strictly necessary cookies for users who decline.