opt-out requirements