Earlier quoted context omitted.
Everything should be opt-in. Burden should be on them, something like, "We want to share your data and if you agree here are the benefits to you."
That's something I think the EU got right -- being hard-nosed about true tracking consent requiring a user to receive the same outcome regardless of their choice. Anything shy is begging companies to dark-engineer patterns around obtaining it.
The first reg this happens in will I think make billions the world over realize this is what the template of all opt-in online regulation has to be and will hopefully change the world.