Privacy-affecting features should be opt-in, not opt-out
Aliases: affirmative consent · express choice · affirmative action
What it is
Opt-in consent activates an optional increase in processing or visibility only after an explicit affirmative action. Non-response, navigation away, or retaining the initial state is not agreement. This differs from opt-out, which begins processing and requires a person to discover and stop it. The action must refer to a concrete purpose and precede the processing, not merely exist somewhere in the interface.
Why it happens
Opt-in places the burden of demonstrating value on the requester and leaves observable evidence of intent. Opt-out exploits status-quo persistence, limited attention, and settings-search costs, counting undecided people as accepters. Yet an affirmative click is ambiguous when bundled with registration, dismissing a modal, or completing a core task: the action may express a wish to proceed rather than a processing preference.
Studying it
Experiments can compare uptake, comprehension, later withdrawal, realized feature value, and regret across opt-in and opt-out, with non-actors retained in the analysis. Process measures include reading time, revisions, and accidental activation; interviews can test when participants believe processing begins. Lower opt-in uptake alone does not establish the authentic preference. Comprehension and delayed confirmation provide stronger evidence.
Where it stops holding
An explicitly requested core operation does not require repetitive opt-ins for each necessary data flow; doing so produces habituated clicking. Emergency communication, account security, and legal duties may rely on a different basis. Marketing, public display, or cross-service tracking does not become necessary merely because it is bundled with the service. Children, high-load situations, and proxy decisions require additional assessment of whether the affirmative action can express a valid choice.
Applying it
- Keep each optional operation inactive until a control naming one purpose and data class is deliberately activated.
- Separate “continue” and “save” from optional agreement; avoid preselection, double negatives, and interpreting dismissal as acceptance.
- Preserve the core journey and a later-decision path for non-actors, with an equally discoverable withdrawal control after activation.
- Test accept, decline, ignore, and accidental-click branches against event logs and traffic; only the explicit activation branch may create the optional flow.