It should not matter if they're following the law. Failure to access some API doesn't mean the user consented. Like the sibling poster said, the default should

It should not matter if they're following the law. Failure to access some API doesn't mean the user consented. Like the sibling poster said, the default should be opt-out. It's not as if this TrustArc modal is some old product that was repurposed for GDPR. This is all planned and done in bad faith, period. It's a dark pattern.