Article 7 is pretty non-specific and does not discuss defaults. Recital 32, however, is quite specific and gives me the answer I was looking for https://gdpr.eu

Article 7 is pretty non-specific and does not discuss defaults. Recital 32, however, is quite specific and gives me the answer I was looking for https://gdpr.eu/recital-32-conditions-for-consent/ https://gdpr.eu/recital-32-conditions-for-consent/ "Consent should be given by a clear affirmative act ... Silence, pre-ticked boxes or inactivity should not therefore constitute consent."