To opt out means to choose not to take part in something you'd otherwise be included in by default. When you opt out of marketing emails, you ask a company to stop sending them. When you opt out of data sharing, you tell a company not to pass your information to others.
The opposite is opting in, where you're left out unless you actively say yes. Privacy laws differ on which one applies. Under the EU's GDPR, consent must be opt-in: a pre-ticked box doesn't count. Under California's CCPA, people have the right to opt out of the sale or sharing of their personal information.
Below: opt out vs opt in side by side, common examples, how long companies have to act on an opt-out, and how to opt out effectively.
Table of contents
- Opt out vs opt in
- What does "opt out" mean?
- Examples of opting out
- How long companies have to honor an opt-out
- How to opt out effectively
- Laws that give you the right to opt out
- Managing opt-outs as a business
- FAQ
Opt out vs opt in
The difference is what happens if you do nothing. With opt-out, you are included until you say no. With opt-in, you are excluded until you say yes.
| Opt-out | Opt-in | |
|---|---|---|
| Default | You are included | You are not included |
| What you have to do | Act to be removed | Act to be added |
| Typical example | An "unsubscribe" link in an email, or a pre-ticked box | An unticked box you choose to tick, or "Accept" on a cookie banner |
| Participation rates | Higher, because most people keep the default | Lower, but people who join are more engaged |
| Under the GDPR | Not valid as consent. People can still object to direct marketing and some other processing. | Required whenever consent is the legal basis, including for non-essential cookies |
| Under the CCPA and other US state laws | The main model: people can opt out of the sale or sharing of their data and of targeted ads | Required for some uses, such as selling the data of children under 16 |
Cookie banners show the difference clearly. An opt-out design loads tracking cookies straight away and lets you turn them off. An opt-in design loads nothing until you accept, which is what the GDPR requires. For more on the business side, see opt-in vs opt-out for businesses.
What does "opt out" mean?
To opt out is to remove yourself from something you are included in by default, such as a mailing list, a data-sharing arrangement or a program at work.
The spelling depends on how you use it. "Opt out" is the verb: "you can opt out at any time". "Opt-out", with a hyphen, is the noun or adjective: "an opt-out link" or "we processed your opt-out".
Examples of opting out
Marketing emails
Clicking "unsubscribe" at the bottom of a marketing email is the most common opt-out. Laws such as CAN-SPAM in the US and PECR in the UK require every marketing email to include a working way to unsubscribe.
Telemarketing calls
National registries let you opt out of most sales calls by registering your number:
- US: National Do Not Call Registry
- UK: Telephone Preference Service (TPS)
- Canada: National Do Not Call List
- Australia: Do Not Call Register
Some callers are exempt, such as charities, political organizations and, in some countries, companies you already do business with. You can also tell any company directly to stop calling you.
Direct mail
In the US, DMAchoice lets you opt out of many marketing mailing lists. In the UK, the Mail Preference Service (MPS) does the same for addressed advertising mail.
Online tracking and data sharing
- Cookie banners. Reject non-essential cookies, or change your choice later through the site's cookie settings.
- Global Privacy Control (GPC). A browser setting that tells every site you visit not to sell or share your data. Businesses covered by the CCPA must treat it as a valid opt-out, as must those under several other US state laws. The older "Do Not Track" signal is ignored by most sites.
- "Do Not Sell or Share My Personal Information" links. Found in the footer of many US websites.
- Ad settings. Google, Meta and other platforms let you turn off personalized ads in your account settings.
Financial information sharing
In the US, the Gramm-Leach-Bliley Act lets you opt out of a bank or financial company sharing your information with unaffiliated third parties. Your opt-out stays in effect until you cancel it.
Wi-Fi location services
If you add "_nomap" to the end of your Wi-Fi network name, Google and some other location services will stop using it to work out where devices are.
Arbitration clauses
Some consumer contracts let you opt out of mandatory arbitration if you send a notice within a set period, often 30 days, after you agree to the terms.
How long companies have to honor an opt-out
| Law | Type of opt-out | Deadline |
|---|---|---|
| GDPR (EU) and UK GDPR | Objection to direct marketing, or other rights requests | Direct marketing must stop once you object. Requests must be answered within 1 month. |
| CCPA (California) | Opt-out of sale or sharing of personal information | 15 business days |
| CAN-SPAM (US) | Unsubscribe from commercial email | 10 business days |
| TCPA (US) | Stop calls or texts from a company | 10 business days |
Many companies act sooner. Email platforms usually remove you from a list immediately.
How to opt out effectively
- Use the company's own route. An unsubscribe link, a preference center or a "Do Not Sell or Share" link is usually processed fastest.
- Be specific. Say whether you want to stop all emails or only some, or all data sharing or only for advertising.
- Keep a record. Save the confirmation email or a screenshot, with the date.
- Check it worked. If messages keep coming after the legal deadline, contact the company again and mention the law that applies.
- Escalate if needed. You can complain to your data protection authority in the EU or UK, the California Privacy Protection Agency or attorney general, or the FTC or FCC for email and calls in the US.
- Be careful with spam. In a message that is obviously spam, clicking "unsubscribe" can confirm your address is active. Mark it as spam instead.
Laws that give you the right to opt out
GDPR
The GDPR generally requires opt-in consent, but it also gives people the right to object, which works like an opt-out:
- You can object to direct marketing at any time, and it must stop.
- You can object to processing based on legitimate interests, and the company must stop unless it has compelling grounds.
- You can withdraw consent at any time, and it must be as easy as giving it.
CCPA and CPRA
California residents can opt out of:
- The sale of their personal information
- Sharing of their personal information for cross-context behavioral advertising
- Use of sensitive personal information beyond what is needed (the "right to limit")
Regulations adopted in 2025 add a right to opt out of some uses of automated decision-making technology, phasing in from 2027. Most other US state privacy laws, including those in Virginia, Colorado, Connecticut and Texas, give similar rights to opt out of targeted advertising, sale of data and profiling.
CAN-SPAM, TCPA and COPPA
- CAN-SPAM requires a clear unsubscribe option in every commercial email.
- TCPA restricts telemarketing calls and texts and requires companies to honor do-not-call requests.
- COPPA requires parental consent before collecting data from children under 13. Parents can allow collection while refusing disclosure to third parties.
Managing opt-outs as a business
If you collect personal data, you need a reliable way to receive opt-outs and act on them within the deadlines above:
- Put an unsubscribe link in every marketing email and suppress opted-out addresses across all your tools, not just one.
- If US privacy laws apply to you, add a "Do Not Sell or Share My Personal Information" link and honor GPC signals. See Do Not Sell My Personal Information for the details.
- Use a cookie banner that blocks non-essential cookies until the visitor opts in, and lets them change their mind later.
- Log every request and when you completed it, so you can prove compliance.
ComplyDog gives you a cookie consent banner and a privacy portal where people can submit data requests and you can track each one to completion. See how it works.
FAQ
Is it "opt out" or "opt-out"?
Both, depending on use. "Opt out" is the verb ("I want to opt out"). "Opt-out" is the noun or adjective ("an opt-out form").
What is the opposite of opt out?
Opt in. Opting in means actively agreeing to take part, for example by ticking an unticked box.
Does opting out delete my data?
Not usually. Opting out stops a specific use, such as marketing or sale of your data. To have your data deleted, you need to make a separate deletion request under laws such as the GDPR or CCPA.
Can a company ignore my opt-out?
Not where a law gives you the right to opt out. Exceptions are narrow, such as messages a company must send you about an account or a legal obligation it has to keep certain records.
