Still shouldn't be on by default, but asking up-front seems perfectly reasonable.
A service provider makes one decision and it impacts N users. A user consumes from M service providers. A user evaluating whether a service provider is trying to “pull one over” on them in the TOS costs M units of time, 1 unit per service provider. A service provider deciding to choose the cow path as the default saves N units of time and costs the service provider 1 unit.
I engage with service providers that respect my time. If I suspect your default is user hostile, and provide a “we won’t exploit you in this relationship” as an option, I look elsewhere.
This breaks down in places though. Example: I haven’t found a communication provider that doesn’t default to building a profile on me and selling it to anyone willing to pay.
The lack of choice for me makes me wish a governing body would intervene and give me a marketplace where I didn’t have to waste my valuable time making sure the person I was engaging with wasn’t going to pull one over on me.
Even more, it speaks to the power of removing choice. When app tracking is enabled by default it effectively removes choice because most users never touch settings (and may not even know they exist). Therefore users are not choosing anything. Someone else is choosing for them. "Tech" company employees will respond to criticism of their employer's behaviour with something like: "But users can choose to turn this off." That is not relevant if 96% are unaware of this "choice". The question is: why is tracking on by default. That was a choice the user did not make.
Only when faced with a screen asking the user if she chooses to be tracked do we get a chance to find out what a user would choose. And even then, developers will use "dark patterns" to manipulate the decision-making process toward a self-serving outcome.
Perhaps we should ask ourselves whether there should even be a setting to enable tracking. If the majority of users would choose to turn it off, if they were presented with the choice, then why even have it. This is essentially "privacy by design".
This is no different than when developers argue to HN that it is not worth catering to the preferences of privacy-conscious or minimalist users since those users comprise such a small percentage of users overall. By the same token, it should not worth catering to the small percentange of users who want to be tracked.