GDPR Article 7:

Art. 7(3): Users must be able to withdraw consent at any time, and it must be as easy to withdraw as to give → This is why an opt-out must exist.