I thought under GDPR, companies had to explicitly ask users to opt-in for any matter related to data protection and privacy. Why users are opted in by default a

I thought under GDPR, companies had to explicitly ask users to opt-in for any matter related to data protection and privacy. Why users are opted in by default and have to opt out?