This absolutely needs an opt-out! This, like it looks here and what is described about it, is not GDPR compliant. For this alone, there needs to be an opt-out!

For GDPR there needs to be IP anonymizing etc.
It needs to be documented what data is stored where, how long, who has access to it and when it will be deleted.

Automatically opt-in such features that in any way affect GDPR/ privacy in general is a no-go!