The rules are pretty straightforward, really, it's just Google banking on the fines for not doing it correctly would be less than the profit made.

"Consent should be given by a clear affirmative act ... Silence, pre-ticked boxes or inactivity should not therefore constitute consent."