Opt-out by default would be huge:

"Under the terms of the OPA, individuals would have the right to obtain, correct, and delete data collected about them by covered entities, as well as to request "a human review" of automated decisions. Users would also have to opt-in to having their personal data used for training machine learning algorithms." https://arstechnica.com/tech-policy/2019/11/new-bill-would-create-digital-privacy-agency-to-enforce-privacy-rights/