I think that the default for collecting any kind of personal data should be opt-in consent.