There needs to be the same kind if active consent whether it’s “required” or not.

The difference is if you can deny access for those opting out or not.