Opt-in：没人点击时会发生什么

Opt-in is a consent model in which data use or marketing contact begins only after a person gives a clear yes. Under the GDPR, that yes must be "freely given, specific, informed and unambiguous," shown "by a statement or by a clear affirmative action."

That definition sounds simple until you look at what happens around the yes. Most people who meet a cookie banner, an app permission prompt, or a signup form don't stop to decide carefully. They close it, ignore it, or scroll past. So the real test of an opt-in isn't the button marked Accept. It's the path where nobody clicks anything at all.

This entry treats opt-in as a consent model across channels, with most attention on cookies, tracking, and app prompts, where the independent evidence is strongest.

Opt-in vs Opt-out: Who Has to Act

The difference comes down to one question. Who has to do something? Under opt-in, nothing happens until the person acts. Under opt-out, the activity starts by default and runs until the person acts to stop it.

That looks like a small procedural switch. In practice it decides how much data exists at all, because most people leave defaults where they find them. For consent-based processing, the GDPR sides firmly with opt-in. Recital 32 says it plainly: "Silence, pre-ticked boxes or inactivity should not therefore constitute consent." Article 7(1) puts the burden of proof on the controller, so the business must be able to demonstrate that consent was given. Article 7(3) requires that withdrawing consent be as easy as giving it.

Read together, those rules give an opt-in three parts: a clear action at the start, a record that proves it, and an exit no harder than the entrance.

What Changes When the Default Flips

The clearest large-scale example is Apple's App Tracking Transparency (ATT) framework. Economists Lennart Kraft, Bernd Skiera, and Tim Koschella studied ATT as a shift from opt-out to opt-in for tracking on iOS. In the United States, the iOS tracking rate they measured fell from 73% before ATT to 18% after it, while among US Android users, who saw no equivalent prompt, it held at roughly 93.7%. Across all 19 countries, tracking rates two years after ATT averaged about 28%. (Tracking rate; 19 countries; working paper, 2021 to 2022 data; VERIFIED.)

An older field study points the same way. Christine Utz and colleagues ran experiments with more than 80,000 unique visitors on a German website. In a privacy-by-default setting, a true opt-in with nothing preselected, fewer than 0.1% of visitors allowed cookies for all purposes. (Field experiment; Germany; ACM CCS 2019; VERIFIED.)

Neither figure is a benchmark for your site. Each describes one setting in one period. What they show is direction and scale: when the default flips, the share of people who end up tracked can shrink sharply, even though the product and audience haven't changed.

Where Opt-in Shows Up in Marketing

Cookie and Tracking Consent

Cookie banners are the web's most visible opt-in mechanism, and among the most often broken. A cross-country study presented at CHI 2025 examined the top 10,000 websites in each of 31 countries covered by the ePrivacy Directive and the GDPR. Consent interfaces appeared on 67% of sites, yet only 15% met minimum requirements, mostly because they offered no way to reject. (Website audit; 31 European countries; peer-reviewed conference paper; VERIFIED.)

Outside Europe the gap opens earlier. A Carnegie Mellon University Africa team analyzed 1,793 websites across 49 African countries: 78% used cookies, but only 17% showed a consent banner or pop-up. The team also reviewed 37 national data protection laws and found that none contained website requirements specifically for cookie opt-ins. (Website audit and legal review; Africa; university report on an ACM COMPASS 2025 paper; VERIFIED.)

These cookies usually feed analytics, retargeting, and behavioral targeting. If a banner offers only "accept" and "settings," the opt-in may not hold up under review, and every audience built on it inherits that weakness.

App Tracking Prompts

Mobile apps moved the consent question out of the browser and into the operating system. On iOS, the ATT prompt sits in front of cross-app tracking, and a decline means no tracking. Results varied widely by market. In the Kraft, Skiera, and Koschella data, Indonesia showed the smallest decline: the iOS tracking rate there fell from about 62% to about 39% after the prompt. (Tracking rate; Indonesia within the 19-country sample; working paper, 2021 to 2022 data; VERIFIED.)

The lesson for app marketers is simple. A permission prompt is an opt-in with a hard default. If the user declines or never answers, tracking stays off, so measurement should be planned around the people who say yes, not everyone who installs.

Email, SMS, and Messaging

Email is where most marketers first meet the term. A single opt-in adds an address as soon as the form is submitted, while a confirmed, or double, opt-in waits until the person clicks a confirmation link. Those mechanics live in the double opt-in entry, and the wider channel under email marketing.

SMS, WhatsApp, and push notifications follow the same logic under their own rules. Each channel has platform policies, and many countries add laws about who may be contacted and how permission is recorded. Those details need a channel-by-channel check. What carries across is the structure above: a clear action, proof of it, and an easy way out.

"Consent or Pay"

A newer variant asks users to accept tracking in exchange for free access or pay for a version without it. Regulators in the EU and the UK are scrutinizing these models. In April 2024, the European Data Protection Board stated that, in most cases, large online platforms offering only this binary choice will not meet the requirements for valid consent. (EDPB statement; EU; REPORTED.)

The No-Click Path: Dismissals, Defaults, and Silence

Every consent prompt has at least three exits. A person can accept, reject, or leave without choosing. Most design effort goes into the first two. The third is where an opt-in quietly succeeds or fails.

Why Interface Friction Moves the Numbers

Small design choices change outcomes more than intuition suggests. Utz and colleagues found that nudging had a large effect on what users chose. A randomized field experiment by Chiara Farronato, Andrey Fradkin, and Tesary Lin, which varied cookie banners through a browser extension, found that placing options behind extra clicks strongly influenced choices and pushed users toward whichever option was easier to reach. (NBER Working Paper 34025, 2025; direction VERIFIED, effect sizes not used.)

This matters beyond compliance. If acceptance rises because rejecting takes extra clicks, the audience you collect reflects the friction, not the preference. A consent rate built that way tells you about your banner, not your customers.

Closing the Banner Is Not a Choice

People frequently close a consent window without making an active choice, a pattern the Farronato, Fradkin, and Lin research describes directly. Their paper treats the default applied on dismissal as one of the main levers a business controls. So what should a closed banner mean?

Under the GDPR, the answer is already written. Recital 32 rules out silence and inactivity as consent, so a dismissal should leave non-essential tracking off. The Utz result shows what an honest default produces: with nothing preselected and nobody pushed, almost no one allows everything.

What Regulators Check (as of November 2026)

The Three ICO Checks

The UK Information Commissioner's Office (ICO) reviewed cookie practices on the country's most visited websites using three checks:

• Are non-essential advertising cookies set before the user can accept or reject them?
• Is rejecting as easy as accepting?
• Are such cookies placed after the user has declined?

Two of the three test the no-click and no-thanks paths, not the yes. By December 4, 2025, 979 of the top 1,000 UK sites had passed their most recent test and 21 were still failing. Of those that passed, 415 did so without intervention, and 564 improved only after initially failing and being contacted by the ICO. (Regulator compliance checks on advertising cookies; UK top 1,000 websites; VERIFIED.)

An earlier, separate finding sets the context. In January 2025, the ICO said it had assessed the top 200 UK websites and communicated concerns to 134 of those organizations. (Regulator assessment; UK top 200 websites; VERIFIED.) The two ICO findings cover different site sets, dates, and outcomes, with enforcement in between, so they are not one trend line. The CHI 2025 audit is a third, independent finding with its own region, sample, and definition of compliance.

Enforcement Beyond the UK

France's data protection authority, the CNIL, decided on September 1, 2025 to fine Google LLC €200 million and Google Ireland Limited €125 million, €325 million combined. The decision covered two breaches: advertisements formatted as emails in Gmail's Promotions and Social tabs without the required consent, and invalid consent for advertising cookies during Google account creation. The published summary does not say which fine relates to which breach. (CNIL decision published by the EDPB; France; VERIFIED.)

Reading Opt-in Numbers Without Misleading Yourself

Opt-in figures circulate widely, and many can't be compared. Three habits keep the reading honest.

First, separate what people say from what they do. Eurostat reports that in 2025, 58.8% of EU internet users chose not to allow their personal data to be used for advertising, up 4.5 percentage points from 2023, and 56.2% restricted or refused access to their location, up 5.4 points. (Self-reported survey; EU; published January 28, 2026; VERIFIED.) These are survey answers, not logged clicks. Never merge them with observed consent decisions into a single rate.

Second, treat any acceptance rate as conditional. Published cookie acceptance figures shift with the country, the research method, and how the prompt was built, and studies of similar questions land far apart. The only figures here that describe a pure opt-in setting are the Utz result and the ATT tracking rates, and each belongs to its own context.

Third, be skeptical of any "average opt-in rate." The research behind this entry found no independent benchmark, from regulators or peer-reviewed work, for email opt-in conversion, single versus double opt-in performance, or opt-in rates in Indonesia and Southeast Asia. That doesn't prove no such research exists. It does mean any number offered to fill the gap deserves a hard look at who measured it and how. Your own consent logs, read alongside your own banner design, are a better guide.

Opt-in Checklist for Marketers

• Start with everything off. Non-essential cookies, tracking, and contact begin only after a clear affirmative action.
• Give rejection equal weight. Reject should be as easy to find and use as accept, on the same layer.
• Make dismissal mean no. Closing a banner should leave the defaults untouched.
• Drop pre-ticked boxes. Recital 32 rules them out.
• Keep a record. Article 7(1) expects you to demonstrate consent, so log who agreed, when, to which wording, and through which interface.
• Make leaving as easy as joining. Article 7(3) requires it.
• Test the no-click path. Load the page fresh, close the banner without choosing, and check which cookies were set.
• Report consent rates with the design attached. A rate without its banner version can't be interpreted.

Frequently Asked Questions

What is the difference between opt-in and opt-out?

With opt-in, nothing happens until the person takes a clear action to agree. With opt-out, the activity starts by default and continues until the person stops it. The ATT data shows how much that default can change the share of people tracked.

Does closing a cookie banner count as consent?

Under the GDPR, no. Recital 32 states that silence or inactivity should not constitute consent, so a banner closed without a choice should leave non-essential cookies off.

Are pre-ticked checkboxes a valid opt-in?

Not under the GDPR. Recital 32 names pre-ticked boxes as something that does not constitute consent. The person must take the affirmative action.

Do I need to prove that someone opted in?

Yes, where consent is the legal basis under the GDPR. Article 7(1) requires the controller to be able to demonstrate consent, which in practice means recording when and how each person agreed.

Can people withdraw an opt-in later?

Yes. Article 7(3) requires withdrawing consent to be as easy as giving it. If agreeing took one click, leaving shouldn't take five.

What is a good opt-in rate?

There is no independent benchmark to aim for. Acceptance figures vary heavily with country, method, and prompt design, so track your own rate over time alongside the banner version that produced it.

Related Terms

• Double Opt-in: the email variant, in which a subscription is confirmed through a link before it becomes active.
• Email Deliverability: whether permitted email actually reaches the inbox.
• First-Party Data: data a business collects directly from its own audience, often on the basis of an opt-in.

Sources

• [VERIFIED] GDPR (EU) 2016/679, Art. 4(11), Art. 7, Recital 32.
• [VERIFIED] ICO, "ICO action secures increased cookie compliance," December 4, 2025. https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/12/ico-action-secures-increased-cookie-compliance/
• [VERIFIED] ICO, "ICO takes action to tackle cookie compliance across the UK's top 1,000 websites," January 23, 2025. https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/01/ico-takes-action-to-tackle-cookie-compliance-across-the-uk-s-top-1-000-websites/
• [VERIFIED] Kraft, Skiera, and Koschella, "Economic Impact of Opt-in versus Opt-out Requirements for Personal Data Usage: The Case of Apple's App Tracking Transparency (ATT)," working paper, October 7, 2023. https://search.ftc.gov/system/files/ftc_gov/pdf/3-Skiera-Economic-Impact-of-Opt-in-versus-Opt-out-Requirements-for-Personal-Data-Usage.pdf
• [VERIFIED] Utz et al., "(Un)informed Consent: Studying GDPR Consent Notices in the Field," ACM CCS 2019. https://arxiv.org/abs/1909.02638
• [VERIFIED] Nouwens et al., "A Cross-Country Analysis of GDPR Cookie Banners and Flexible Methods for Scraping Them," CHI 2025. https://arxiv.org/abs/2503.19655
• [VERIFIED] Carnegie Mellon University College of Engineering, "Clicking away consent," August 1, 2025. https://engineering.cmu.edu/news-events/news/2025/08/01-clicking-away-consent.html
• [VERIFIED, direction only] Farronato, Fradkin, and Lin, "Designing Consent: Choice Architecture and Consumer Welfare in Data Sharing," NBER Working Paper 34025, 2025. https://ideas.repec.org/p/nbr/nberwo/34025.html
• [VERIFIED, direction only] Lin, research summary of the cookie consent field experiment. https://tesarylin.github.io/research/dark-pattern
• [VERIFIED] Eurostat news release, January 28, 2026. https://ec.europa.eu/eurostat/web/products-eurostat-news/w/ddn-20260128-1
• [VERIFIED] EDPB, "French SA: cookies and advertisements inserted between emails, Google fined 325 000 000 euros," September 4, 2025. https://www.edpb.europa.eu/news/french-sa-cookies-and-advertisements-inserted-between-emails-google-fined-325-000-000-eur-by_en
• [REPORTED] EDPB, statement on "consent or pay" models, April 17, 2024. https://www.edpb.europa.eu/news/news/2024/edpb-consent-or-pay-models-should-offer-real-choice_en