There are two issues:
1. The cookie drop that makes it possible. That's opt-in.
2. The lawful basis for processing the data. That can be consent or it can be legitimate business interests (and any of the other lawful basis). If consent then it needs to be explicit but if you think that you can justify one of the other lawful reasons then it's opt-out (or maybe, in extreme cases, not even opt-out; we don't have any of those).
That's what our lawyers are telling me.
Biting the hand that feeds IT
