It should be opt-in, not opt-out.

The fact that there's no law mandating opt-in only for data retention consent (or any anti-consumer "feature") is maddening at times