Interfaces should make understanding opt-out, not opt-in