Consent: opt-in vs. opt-out

The cookie popup has been welcoming users to their favorite sites since 2018. It’s had many iterations over the years, from the vague ‘Want to accept cookies?’ to the extensive privacy policy popup we know today. Cookie popups are likely to change even more with the deprecation of third-party cookies, but will still remain the gateway to websites and apps we use every day.

Though we now recognize (and expect) the cookie popup when we’re browsing, not many users read through the privacy policy and vendor list, instead electing for the ‘Accept all’ or ‘Reject all’ option when prompted. But if you take a closer look at the language within the cookie popup, you might start to see the phrases ‘opt in’ and ‘opt out’ appear. So, what’s the difference between opt-in and opt-out consent?

What is opt-in consent?

Opt-in consent is used when the site requires users to manually accept cookies or consent to marketing. The cookie popup appears with a series of tick boxes that are unchecked, and the user can choose to accept or decline however many they’d like. There may also be an option for users to opt in to all, or none, with a button at the bottom of the popup.

Opt-in consent is required by most countries and stipulates that should a user want to opt out of any selected permissions, the process of opting out should be readily available and simple. It also states that advertisers, publishers, and marketers are not permitted to use or collect a user’s data unless they have opted in.

What is opt-out consent?

Opt-out consent is used when a user is automatically opted in to data collection and marketing, and must ‘opt out’ if they would not like their data to be used. Opt-out consent is only used under certain legislation, like the California and Virginia laws around online privacy and data protection.

Much like opt-in consent, users should be able to easily select which permissions they agree to, found in a privacy policy either within the popup or on the site’s page. Since different countries require different acceptances, site owners and ad networks often choose to use a consent management platform (CMP) to ensure compliance with legislation like the EU’s GDPR.

When should I use opt-in and opt-out consent?

Oftentimes opt-in and opt-out consent come down to the location of the user or site, and the type of data being collected or transferred. Opt-in consent is always used for sensitive data or when dealing with minors. Several countries only permit opt-in consent over opt-out consent, but more American legislation is permitting the use of opt-out consent.

If you’re a site owner who wants to simplify the cookie collecting process, you can apply to become a part of the Collective. We work with CMP’s like Sourcepoint to safely manage user data and comply with global privacy legislation. To hear more about how we work with Sourcepoint, check out their contributions to our webinars on our Resources page here.