Under GDPR Article 4:
‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her
Under Recital 32:
Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent.
Thus any forms using the older opt-out method do not seem to be establishing consent for processing in a manner compliant with the GDPR. I suppose that if the subject has previously given consent in some other explicit way, an opt-out checkbox could be a method of withdrawing consent. But I suspect that such sites have simply failed to make needed changes. Or perhaps those running such sites believe that their processing would be lawful on some basis other than consent.
