> By definition an “opt out” setting is selected by default.
No, (IMO) an "opt out" setting / status is assumed/enabled without asking.
So, I think this is opt-in, until Sept 28.
Opt-in, whether pre-checked/pre-ticked or not, means the business asks you.
GDPR requires "affirmative, opt-in consent", perhaps we use that term to mean an opt-in, not pre-ticked.
Regardless whether it's opt-in or opt-out, the business will need to confirm anything it opted for you by asking. If you don't select the opposing choice in a timely fashion, then the business assumes that it opted correctly in your interest and on your behalf.
> So, I think this is opt-in, until Sept 28.
If the business opted for consent, then you will effectively have the choice for refusal, a.k.a. opt-out.