Opt in and opt out are the two possible defaults, and which one applies is not a choice a company makes. It is decided by the activity and by where the person is, which is why the same mailing list can be lawful under one default in one country and not in another.
The two defaults
Opt in: nothing happens until the person says yes. Opt out: it happens until they say stop. Everything else in this area is a consequence of which default applies, including how much evidence you need, since a yes has to be provable and a silence does not.
US marketing email: opt out
CAN-SPAM permits sending to people who have not asked, provided the message is honest about who it is from, includes a physical address, and honours an opt-out within 10 business days under 16 CFR Part 316. That is a genuinely lower bar than most people assume, and it is a bar about honesty rather than permission.
EU tracking and marketing: opt in
Consent must be given by a clear affirmative act before non-essential cookies are set or marketing is sent. Pre-ticked boxes and continued browsing are not consent. This is the rule that produced the banner, and it applies to people in the EU regardless of where your servers are.
California: opt out, with a published route
The right to opt out of sale or sharing under the CCPA is an opt-out with a specific published link required by Civil Code section 1798.135, and share reaches cross-context behavioural advertising even where no money changes hands. A business can be opt-out by default and still have a hard obligation to publish the route.
The engineering answer
Build for opt in and record the state per activity. A system that can capture and evidence a yes can always represent a no; a system built for opt-out cannot be upgraded to evidence consent without rebuilding the record.
Questions people ask about opt in vs opt out
Can we use one default worldwide?
You can use the stricter one, which is opt in, and many companies do because the operational simplicity is worth more than the marginal reach. You cannot use the looser one worldwide.
Is a pre-ticked box ever acceptable?
Not where consent is required. Where opt-out applies it is not consent at all, so the box is irrelevant and the obligation is the working unsubscribe.
What about existing lists?
Whichever default applied when they were collected is the one you have evidence for. Migrating an opt-out list into an opt-in regime means re-permissioning it, and re-permissioning campaigns typically keep a small fraction, which is the real cost of getting it wrong at the start.