it really depends on how the organization's legal counsel interprets the laws and how risk-averse they are. Some organizations might say only Germany requires double opt-in, while others also include Austria and Switzerland. Some organizations might say the US operates under "everyone is opted in until they opt out" while others might say everyone needs to opt in, regardless of country.

Furthermore, there is compelling evidence that obtaining consent can result in bias, which, in certain circumstances, can affect the outcome of the analysis. Introducing bias into data would not be in the interest of any of the stakeholders.

The EDPBrecommends as a best practice that consent should be refreshed at appropriate intervals.Providing all the information again helps to ensure the data subject remains well informed about howtheir data is being used and how to exercise their rights.

For example, as the GDPR requires that a controller must be able to demonstrate that valid consentwas obtained, all presumed consents of which no references are kept willautomatically be below theconsent standard of the GDPR and will need to be renewed. Likewise as the GDPR requires a“statement or a clear affirmative action”, all presumed consents that were based on a more impliedform of action by the data subject (e.g.a pre-ticked opt-in box) will also not be apt to the GDPRstandard of consent.