No, actually. Even before GDPR, it was illegitimate to use a pre-checked checkbox, or any other process that required out-out from the user.

This requirement was generally respected–I actually don't remember a single instance of it not being followed by European organisations.