Ideally opt-in would be explicit, but a browser toggle could bypass even showing the opt-in button if the Do-Not-Track header is sent.