Opt-in consent is the affirmative model where a user must actively agree — through a clear, deliberate action — before data collection or processing begins. Under GDPR Article 4(11) and Recital 32, consent must be freely given, specific, informed, and unambiguous, expressed by a positive act. Pre-ticked boxes, silence, inactivity, and continued scrolling don't count. It's the default model under GDPR and ePrivacy for all non-essential cookies, marketing tracking, and profiling. Contrast with opt-out (CCPA), where processing is allowed until the user says no. Opt-in also requires the option to withdraw consent as easily as it was given — Article 7(3).