Hi,
So first off, it comes down to:
1. Is the user opting out of cookies?
2. Or is the user opting out of tracking?
Those are very different things....
As far as most policies seem to indicate, the opt out is about cookies (specifically cookies that "fingerprint" a user.
So in Adobe, this means that you need to make sure your ECID isn't set in this scenario.
Now, if you are using the old AppMeasurement.js tracking... there are still the s cookies (which will get set in the absence of the ECID)... but in the Analytics Extension, there is an option to set the cookie lifetime to session which should qualify under your policy... as once the user leave, then next time they come back they will get an all new cookie... thus, they are not being "followed". (Make sure you test that to be sure it's working as expected).
So now that you have the cookie settings in place, you shouldn't have to prevent tracking from firing in an opt-out situation... you just need to ensure that the ECID isn't being set (for opt outs), and that the s cookies expire between sessions... The ECID can be set for opted-in.
This will of course inflate your UVs, so you might want to have a dimension to indicate what users are opted in and which are opted out (so that you can create segments to isolate the behaviours).
If you are using WebSDK, I am not sure what cookies are set here, but if there are any sort of fallback cookies to the ECID, I would expect a similar "session" expiry setting or some sort of cookie opt out option....
For Apps, this is a little odd... since an app is installed to a specific device, and there are so many "device identifiers" I am not really sure what an opt out would do? I mean, I suppose you could prevent the ECID from being set, and generate a new "visitor id" on each use for an opt out... that should prevent you from following the user from visit to visit.... Now, I can understand the opt-out for advertiser ids... since no one likes the creepy ads that start to follow you based on what you did in an app... but from an analytics perspective, if someone installed an app, that is essentially identifying yourself as a regular user... not sure why you would opt out of that... but I am sure with some creative visitor ids, you could replicate a "non-following behaviour" in the app....