Close enough for (non)government issue.
You don't opt in or out of the law, as such, but rather you can choose to opt in to letting a legal entity handle your personal data (which is defined pretty broadly in the GDPR, which is why many US sites simply geofence any EU IP:s — they want to track user activity, per IP or some other identifying data point, but don't want the hassle of setting up a system that gives the user control of that tracking… so they just bar the user completely).
The problem here is that it is imperatively and explicitly the individual who must actively choose to give the entity the right to handle the data. The entity pre-approving themselves would probably be dealt with more harshly than not asking for approval at all: it suggest that you were aware of the rules, but chose to try to circumvent them. You've skipped right past ignorance and gone straight for malice at that point. There are some exceptions, such as direct advertising, where the advertiser has the right to collect data for the purpose of identifying potential customers, providing they forget about it the second the ads have been sent or the customer tells them to stop. CI¬G is not a direct-advertising firm; this exception does not apply.
That said, reports have that it appears non-checked for many without any action on their part, and that this was just a single code rollout that went slightly awry and was quickly fixed, but still… when you're dealing with GDPR features, you really want to double-check your work, or it will hurt. A lot.
