When a customer receives their initial Privacy Notice the form describes two (2) ways for the customer to opt out. One (1) is the mail-in option and included with the notice is a mail-in opt out form for the customer to select a box and mail to the address provided on the form. The second option is for the customer to contact the Bank at the toll-free number provided on the form . However, when the Bank delivers their annual notice the customer’s only option to opt-out is the Call-in option. Per section 216.7(a)(2)(iii) states, "Unreasonable opt out means you do not provide a reasonable means of opting out if the only means of opting out as described in any notice subsequent to the initial notice is to use a check-off box that you provided with the initial notice but did not include with the subsequent notice.” Does this mean the Bank’s annual notice is not in compliance because the check off box/mail-in option was included in the initial, but not included in the annual notice?

"the only means of opting out as described in any notice subsequent to the initial notice is to use a check-off box that you provided with the initial notice "

No - you said you provided the toll-free number in the subsequent notice.