Regulations such as the EU's GDPR and California's CCPA require that default settings involving data collection and fees must adopt an opt-in rather than opt-out approach.