5 Takeaways from 2024’s Industry Events: A Privacy Pro’s Perspective
In September, the Osano privacy team was lucky enough to attend a...
Read NowGet an overview of the simple, all-in-one data privacy platform
Manage consent for data privacy laws in 50+ countries
Streamline and automate the DSAR workflow
Efficiently manage assessment workflows using custom or pre-built templates
Streamline consent, utilize non-cookie data, and enhance customer trust
Automate and visualize data store discovery and classification
Ensure your customers’ data is in good hands
Key Features & Integrations
Discover how Osano supports CPRA compliance
Learn about the CCPA and how Osano can help
Achieve compliance with one of the world’s most comprehensive data privacy laws
Key resources on all things data privacy
Expert insights on all things privacy
Key resources to further your data privacy education
Meet some of the 5,000+ leaders using Osano to transform their privacy programs
A guide to data privacy in the U.S.
What's the latest from Osano?
Data privacy is complex but you're not alone
Join our weekly newsletter with over 35,000 subscribers
Global experts share insights and compelling personal stories about the critical importance of data privacy
Osano CEO, Arlo Gilbert, covers the history of data privacy and how companies can start a privacy program
Upcoming webinars and in-person events designed for privacy professionals
The Osano story
Become an Osanian and help us build the future of privacy!
We’re eager to hear from you
Updated: October 18, 2023
Published: August 29, 2022
Have you ever asked a friend what they wanted to eat for dinner? Sometimes, they clearly answer: "I want to go to Torchy's Tacos!" That's a great example of an opt-in.
Sometimes, the answer isn't so clear. In that case, you may offer your friend a couple of options, like whether they want to eat at Home Slice Pizza, Hopdoddy Burger Bar, or Sushi Zushi. When the answer to those options is, "I don't feel like pizza, burgers, or sushi," they've just opted out of all of your suggestions.
When it comes to privacy online, there are several types of consent models—opt-in (sometimes called “explicit” consent), opt-out (sometimes called “implicit” consent), and hybrid. Different privacy regulations require different consent regimes. Staying compliant means keeping up to date with the latest laws.
In this article, we'll discuss the meaning of opt-in, opt-out, and hybrid consent; the laws that require each; and how to be sure you comply with all the privacy regulations.
Opt-in consent requires users to take a specific action that gives a business consent to collect and use their information. These activities include ticking a box, clicking a button, or taking another proactive measure to establish consent. Businesses may utilize these opt-in methods for newsletters, subscriptions, and cookies, or other data trackers.
Under many data privacy regulations, companies cannot collect consumers’ personal information without them saying “yes” explicitly first. That includes dropping cookies on the consumer’s browser. If a business cannot deploy cookies, then it is much more difficult to track user behavior.
Opt-in consent is more common outside the U.S., where data privacy laws like the GDPR are structured to give users more control over their data. Even when opt-in consent is not required, this method can build a greater level of trust with consumers and encourage brand loyalty—especially when handling sensitive information. Because opt-in consent requires a clear and explicit action, however, it can result in less user data for use in, say, marketing analytics.
The opt-out model requires businesses to divulge that it collects and uses information and gives consumers the option to opt out. In contrast to the opt-in model, companies using the opt-out model assume consent until a person takes action to revoke permission.
Note that data privacy laws using the opt-out model require businesses to very explicitly inform consumers about any data collection. That’s why you still see cookie notices on websites that use an opt-out model for consent. Consumers still need to be able to opt-out easily, too; under the California Privacy Rights Act (CPRA), for instance, businesses need to include links on their homepage reading “Do Not Sell or Share My Personal Information” and “Limit the Use of My Sensitive Personal Information.”
Both opt-in and opt-out models serve as valid approaches to securing a consumer’s consent to data collection and processing—but only under certain laws and certain circumstances.
Opt-in or explicit consent is considered to be the higher standard, which is why it’s the default for regulations like the GDPR. The GDPR requires consent be freely given, specific, informed, and unambiguous, and only opt-in consent can meet that standard.
Opt-out consent, by contrast, requires further action on the consumer’s part. They may have to navigate to a different UI to make their opt-out request, for instance. But because businesses can begin collecting data until that request is made, businesses using an opt-out model often have access to more data for a variety of purposes compared to those using an opt-in model.
Because opt-out models are more common in the U.S., U.S. privacy laws are often construed as being more business-friendly, while the GDPR is considered to be more consumer-friendly.
It’s important to note that even if you aren’t required to use opt-in consent, you may still wish to do so in order to play it safe with your organization’s compliance and demonstrate a greater commitment to consumer privacy.
Privacy isn't always an either/or situation. Sometimes, both models are needed.
A hybrid model incorporates aspects of opt-in and opt-out models depending on the type of information collected and how the business will use it. In this scenario, a company may use an opt-out regime for personal information and an opt-in regime for sensitive personal information.
MarketingWeek reported on a study by fast.MAP in partnership with Tangible and Opt-4 on user behavior regarding consent. Of the respondents surveyed, "29% would opt-in to emails and other messages, compared with 51% who say they would not opt-out." Thus, the hybrid method gives consumers more control over how their personal data is collected and processed while providing businesses a better chance of receiving non-sensitive personal information.
Learn how to stay compliant with our Cookie Consent FAQ guide - Download here.
It is possible to obtain actionable information while ethically complying with data privacy regulations. Once you know the obligations of privacy regulations, like the GDPR and CCPA/CPRA, you can tailor your business and marketing strategies to secure consent without running afoul of the regulatory bodies.
In the EU, ePrivacy and the GDPR overlap a bit when it comes to what consent is required for the use of cookies. Together, they create a pretty rigid privacy regime. As such, these regulations give EU citizens significant control of their personal information, no matter where they are in the world.
The GDPR states that "consent must be freely given, specific, informed and unambiguous," as indicated by a "statement or a clear affirmative act." For example, a business may utilize a cookie banner at the bottom of its website when a consumer from the EU visits for the first time. The language on the banner should be clear, easy to understand, and allow users to accept the cookies. Until the user communicates consent, the business cannot collect personal information or use tracking cookies to monitor consumer behavior.
While ePrivacy and the GDPR require explicit opt-in consent, the CCPA/ CPRA gives consumers the right to opt out. This means that California residents over the age of 16 can tell businesses not to sell or share their personal information.
To give consumers adequate time and information to decide whether they should opt out, the CCPA requires businesses to provide a "notice at collection" at the time of or before the point of collection. According to the CCPA, the notice should list the categories of personal information businesses collect about consumers and the reasons they'll use each type of data.
How should businesses treat minors under CCPA? Opt-in consent is the default for minors between the ages of 13 and 16. These children may opt into the sale/share of personal information, but it must not be collected or processed until then. Parents or guardians of children under 13 must opt in on their behalf.
The data privacy landscape is constantly evolving, and staying on top of the latest compliance requirements can feel like a full-time job. More than 750,000 websites use Osano's Consent Management Platform to stay compliant with worldwide data privacy regulations. No matter where your web visitors come from, the intelligent consent feature displays and enforces the correct consent requirement based on geolocation data, with support in more than 40 languages.
With just one line of code, your website will be immediately compliant with the data privacy laws in over 50 countries. Sign up for a demo to see for yourself!
Learn how to set up a cookie consent program, what is involved in cookie consent, what happens if you don't use a cookie policy on your website and more.
Download Now
Osano Staff is pseudonym used by team members when authorship may not be relevant. Osanians are a diverse team of free thinkers who enjoy working as part of a distributed team with the common goal of working to make a more transparent internet.
Osano is used by the world's most innovative and forward-thinking companies to easily manage and monitor their privacy compliance.
With Osano, building, managing, and scaling your privacy program becomes simple. Schedule a demo or try a free 30-day trial today.