It is actually illegal to share personal data by default.
Consent cannot be implied and must always be given through an opt-in, a declaration or an active motion, so that there is no misunderstanding that the data subject has consented to the particular processing.
I think they initially had the button disabled (which would not be confusing at all) until legal review, after which they just changed the default setting.
I also think that the ambiguity they created even confuses their own support/twitter team. I don’t think this official response is correct:
https://twitter.com/RevolutApp/status/1191829841819123713?s=20
Even though it may seem strange that the toggle is on initially, there is no actual room for interpretation. If the toggle is on, it means opt-out. That’s clearly what it says.
A toggle button is not an action control, it represents a state.
Edit, LOL: