Be aware, this changes in 316 days, when the EU GDPR comes into force, and makes even for those cases opt-in required.

Opt-in via published policy or some silly explicit checkbox?

Opt-in via an explicit dialog, and, most importantly, you have to give the user the ability to select "no" and still use your website (in which case you aren’t allowed to do any tracking).