Hi Anh, it really depends on how the organization's legal counsel interprets the laws and how risk-averse they are. Some organizations might say only Germany requires double opt-in, while others also include Austria and Switzerland. Some organizations might say the US operates under "everyone is opted in until they opt out" while others might say everyone needs to opt in, regardless of country.
There is also the distinction between opt-in for marketing communications (which typically can be managed by marketing operations) and data storage and processing (which impacts all areas of the business and typically is managed by a data governance team). There's a little about the latter - data storage and processing regulations - on the Adobe Privacy Service documentation.