I wouldn't be surprised if both are illegal. But these days, the correlation between "X is illegal" and "larger org's do not do X" just ain't what it yousta be.
My understanding is that it's legal with opt-in, but the opt-in is allowed to be confusing, opaque, and sticky, so most people "consent" without informed consideration. We really need to revisit contract law in a modern context. Call me crazy but I don't think it's reasonable that our society operates in such a way that easily 90+% of people are subject to contract terms they signed but don't know or understand.
Damn near anything in business in the US is allowed with "opt in" where the opt in is literally the scene from Charlie and the Chocolate factory, including the part where you don't get to come after the factory for your death and dismemberment as stated in 1pt font after an entire chapter of reading to dull your attention.
On top of the GDPR/American concept of "it is all OK if there is consent" which applies to most organization, health related organizations face stronger HIPPA regulations in the US.
Most long contracts are a reaction to 'failure to warn' lawsuits where plaintiffs (successfully) argued that they should have been notified of something. The problem is that when you add up all those 'somethings', you get absurdly long documents.
I agree that these extensive disclaimers and contracts are not an effective way to communicate information, but dispensing with them will require either a better way to disclaim many (relatively unimportant) risks, or a change to product (and service) liability law, reducing failure-to-warn legal risk.