[cdrx]

> Isn't this what's written in the GDPR?

I wish it was this explicit, but it isn't. EU member states have all interpreted the regulation differently.

Making it harder to opt out than in is explicitly prohibited in the UK and Germany. It is perfectly legal in Italy. In Spain, it is legal to bury the opt out buttons at the end of a 50 page cookie policy.

Full compliance, across the whole of the EU, is exceptionally difficult.