The two paradigms for acquiring data subject consent: opt-in requires affirmative consent before data collection begins; opt-out places the burden on the individual to proactively refuse collection, with collection as the default. Most commercial surveillance systems use opt-out or "implied consent"