From what I saw there where two options, off and on. But there wasn't a default set, by GDPR rules I believe if On isn't selected when you save then it must be Off.
As GDPR requires opt-in yes, that is the behavior it should have, though IMO I doubt it is implemented like that
then they might have problems if someone who knows whats what says show me