This proposal is actually better than GDPR in terms of consent. I work for a software company that (among other things) builds solutions for GDPR, and the consent part can get frankly ridiculous. Like if you want to buy a shirt from a small online clothing retailer (can even be a mom-and-pop business), you need to agree to 5 or 10 separate clauses related to privacy, because they are the minimum required to technically run the store online (cookies, order history, etc.), and more if you want to approve all the "recommended" things (e.g. login history). Not to mention there are some apparent contradictions with other regulations in non-EU countries, e.g. about keeping transaction history.
As much as privacy is valuable, an opt-out approach protects it almost as much, but also doesn't pollute simple online processes like registration, shopping, etc.