In the EU they are by law. In reality not all websites disclose all services they share data with though. And all users click accept in the cookie pop-up anyway.
Have you seen those pop ups with a button to consent to cookies and a link to a privacy page where usage of 3rd party services like Fullstory has to be disclosed? That's your opt-in.
