... While the publicly visible behavior is like you don't have hats (e.g. it's not visible on your avatar, you don't count towards the site leaderbords, etc.), the fact that you deserve the hat is recorded for all users, regardless of opt-out status. So once you opt back in, the hats are immediately there.
If that's indeed the case (I trust somebody like balpha ♦ does know), then I wonder about this part of it: "the hat is recorded for all users, regardless of opt-out status". I.e. isn't that a violation of at least these GDPR rules:
- Something like "do not track me" seems to not apply (even if you opted-out, the recording continues).
- The default for opt-in/opt-out is that everybody is opted-out, and any user needs to explicitly opt-in (a user who does not want to participate in Winter Bash, must indicate I hate hats).