I've often wondered what basis companies are using for the "opt-in to tracking or pay to opt out model". It has spread now to even fairly reputable organisations.

This, at least to my understanding, runs contrary to the spirit of the GDPR regulations. Permission has to be freely given which, when the alternative is paying a subscription, it quite obviously isn't.