Both are necessary. Otherwise, you get the 'opt-in = site loads immediately, opt-out = site takes >1 minute to load' scenario and everyone opts in anyway.