It’s not entirely clear, but it appears to be up to the instance operator.
Users can disable referer headers in their browser settings which overrides anything the instance operators can do.
Only nerds do stuff like mess with their browser settings through about:config. The bulk of activity is from people who don’t mess with those settings and don’t stay aware of what’s going on. Those are the ones who the info gatherers want to observe, so that’s why the system should be opt-in in every case, and it’s also why they want it to be the opposite.