This makes only sense though when Matomo users are aware to not embed the opt out iframe when using the consent feature. If the Matomo user / website owner is not aware that they are mutually exclusive, then an opted out user would not expect to be tracked.

The safe solution that respects the privacy of users more be to never track when the user has opted out. (This is the current implementation).

So should that be changed or not? Or should we make that configurable maybe?

I think we at least need to know when a request was consented (eg. add &consent=1), this would be useful to prove that the request had indeed consent enabled.

Regarding whether to track users who have given consent + User opted-out earlier. I'd be fine keeping current behavior as this should be a rare case and therefore not very important either way.

Or should we make that configurable maybe?

Possibly, can you think of a practical way to make it customisable?

edited the title and description:

We will keep this behavior but we want to make it clear which requests were consented. Then someone could write a plugin or we could add a setting, to change and ignore the opt-out when consent is given (we'll keep it privacy by default in core).