They should be asked before activated though it is acceptable to select “Yes” by default.
Perhaps a checkbox on the login page?
Under the new European GDPR rules, “Yes by default” is NOT acceptable. Users have to explicitly agree to allow ANY personal data to be collected. N.B. Their IP address is considered personal data under the regulations even though it could apply to more than one person.