Actually, this is not valid under the GDPR. It explicitly states that data sharing must be opt-in. To make it valid, everything must be deselected by default.

Actually, this is not valid under the GDPR. It explicitly states that data sharing must be opt-in. To make it valid, everything must be deselected by default. But there is another pattern, that actually is allowed. Have everything deselected, put a "select all" button somewhere people easily click it by mistake, and offer no "deselect all" button.