Opt-in / opt-out

Opt-in and opt-out describe how a person's agreement to a data processing operation or marketing approach is obtained. Under the opt-in model, processing only becomes lawful once the data subject has agreed through an active, clearly affirmative action - for example by deliberately ticking a box. Under the opt-out model, by contrast, the processing is presumed to be permitted as long as the person does not object; the burden of taking action therefore rests with the data subject.

Under the GDPR, opt-out is generally not permitted for consent within the meaning of Art. 4(11) and Art. 7 GDPR. Consent must be given freely, for the specific case, in an informed manner and unambiguously; pre-ticked boxes or inactivity expressly do not suffice under Recital 32 and the case law of the CJEU (Planet49, C-673/17). Wherever processing is based on consent - such as for non-essential cookies or email marketing - a genuine opt-in is therefore mandatory.

Opt-out mechanisms nevertheless retain their place, though on a different legal footing: where processing relies on legitimate interest under Art. 6(1)(f) GDPR, the person may object under Art. 21 GDPR - for direct marketing even without giving reasons and with absolute effect. The narrowly defined existing-customer marketing under Section 7(3) of the German Act against Unfair Competition (UWG) also works as an opt-out. Controllers must therefore determine cleanly for each processing operation whether they need an upfront opt-in or whether a downstream opt-out (objection) is sufficient.