Does the GDPR define what the default behavior should be when the user refuses to specify? Does it vary by site? Is it like clicking either “Accept all” or “Reject all”?