The California Consumer Privacy Act has an opt-out policy - i.e., the user data can be collected by anyone and by any means to process it as long as the user themselves does not reach out to the one processing the data. And the GDPR has an opt-in policy which mandates the businesses to seek for consent even before collecting the data from the user.