Opt in and opt out are the two possible defaults, and which one applies is not a choice a company makes. It is decided by the activity and by where the person is, which is why the same mailing list can be lawful under one default in one country and not in another.
The two defaults
Opt in: nothing happens until the person says yes. Opt out: it happens until they say stop. Everything else in this area is a consequence of which default applies, including how much evidence you need, since a yes has to be provable and a silence does not.
US marketing email: opt out
CAN-SPAM permits sending to people who have not asked, provided the message is honest about who it is from, includes a physical address, and honours an opt-out within 10 business days under 16 CFR Part 316. That is a genuinely lower bar than most people assume, and it is a bar about honesty rather than permission.
EU tracking and marketing: opt in
Consent must be given by a clear affirmative act before non-essential cookies are set or marketing is sent. Pre-ticked boxes and continued browsing are not consent. This is the rule that produced the banner, and it applies to people in the EU regardless of where your servers are.
California: opt out, with a published route
The right to opt out of sale or sharing under the CCPA is an opt-out with a specific published link required by Civil Code section 1798.135, and share reaches cross-context behavioural advertising even where no money changes hands. A business can be opt-out by default and still have a hard obligation to publish the route.
The engineering answer
Build for opt in and record the state per activity. A system that can capture and evidence a yes can always represent a no; a system built for opt-out cannot be upgraded to evidence consent without rebuilding the record.
Existing lists, moved across a border
A list built lawfully on opt-out in the United States cannot be mailed to people in the EU on the strength of that silence; the EU default asks for a recorded yes. The honest options are to ask the EU addresses for consent once, keep the ones who say yes, and stop mailing the rest, or to rely on the existing-customer exception where it genuinely applies. The other direction is easier: a consented EU list can be mailed under opt-out rules without change. The engineering answer above is why this is not painful for a company that recorded the state per person: the record says who said yes, when and for what, and the border question is a filter.
Questions people ask about opt in vs opt out
Can we use one default worldwide?
You can use the stricter one, which is opt in, and many companies do because the operational simplicity is worth more than the marginal reach. You cannot use the looser one worldwide.
Is a pre-ticked box ever acceptable?
Not where consent is required. Where opt-out applies it is not consent at all, so the box is irrelevant and the obligation is the working unsubscribe.
What about existing lists?
Whichever default applied when they were collected is the one you have evidence for. Migrating an opt-out list into an opt-in regime means re-permissioning it, and re-permissioning campaigns typically keep a small fraction, which is the real cost of getting it wrong at the start.
Does a soft opt-in exist in the EU?
For email marketing to existing customers, yes: where the address was collected in the course of a sale of a product or service, the messages are about similar products or services, and the person was given a simple way to refuse at collection and in every message. It is narrow, it does not cover prospects, and it does not cover cookies.
What does CAN-SPAM require of the opt-out itself?
A clear and conspicuous way to opt out in every message, a mechanism that works for at least thirty days after the message is sent, honouring the request within ten business days, and no fee, no login and no more than an email address and the preference asked of the person to do it. Once they have opted out, their address is not sold or transferred.