Under most circumstances, the OCPA uses an opt-out model, which means explicit consent is not required prior to the collection of personal data—rather, consumers must be given the option to opt out of personal data collection. However, consumers must opt-in for the collection of sensitive data.