Opt-out is the default-allowed model used under CCPA/CPRA and other US state privacy laws: businesses can collect and process personal information unless the user actively opts out. California requires the mandatory "Do Not Sell or Share My Personal Information" link on every regulated site, plus a "Limit the Use of My Sensitive Personal Information" option under CPRA. Businesses must also honor Global Privacy Control (GPC) as a valid universal opt-out signal. Similar frameworks apply in Colorado (CPA), Virginia (VCDPA), Connecticut (CTDPA), and others. Under GDPR, opt-out is not enough for non-essential cookies — Europe uses opt-in.