Skip to content

Opt-in vs Opt-out

Opt-in and opt-out are the two fundamental consent models used in data privacy regulations worldwide. Under an opt-in model, no personal data may be collected until the user takes an affirmative action to grant consent. Under an opt-out model, data collection begins by default and the user must take action to refuse. GDPR and Saudi PDPL both mandate opt-in for non-essential data processing. CCPA follows an opt-out model. For MENA businesses, Saudi PDPL requires opt-in consent while UAE PDPA requires opt-in for sensitive data. Arqam360's auto-regime detection uses the visitor's IP country to determine the applicable regulation and applies the correct consent model automatically — opt-in for EU/Saudi visitors, opt-out for California visitors.

Key Points

  • Opt-in: no data collection until user actively consents (GDPR, PDPL)

  • Opt-out: data collected by default, user can refuse (CCPA)

  • Auto-regime detection applies the correct model based on visitor location

  • Pre-ticked boxes and implied consent do not qualify as valid opt-in

FAQ

Opt-in vs Opt-out FAQ

Common questions about consent models.

GDPR requires opt-in consent for non-essential cookies and tracking. All categories must default to denied until the user actively grants consent.

See it in action

Check which consent model your site is using with our free compliance scanner.

Free Cookie Scanner