The opt-in is only required if they collect your information. If they take the default as opt-out then they don't have to show you any prompt and have no liability.