Trying to guess when this will happen is not promising. This Sunday will mark 1 1/2 YEARS since the proposed reg was published in the Federal Register on 7/15/04! My inclination is to say that it can't be much longer, but who would have thought it would even be this long?
I think it has been delayed by conflicting demands for other regs, including the other FACT Act regs. There will be at least a six month gap between the issuance of the final regs and the mandatory compliance date, so the earliest it will be required would be the second half of this year. I think they wil probably also allow institutions some additional leeway to wail until their next annual privacy notice.
Jack/Pegasus raises a good point. The proposed regs, while requiring an opt-out, say that one of the ways that you can satisfy the opt-out requirement by giving an opt-in! I don't know how many institutions will want to do that, but it's proposed as an option.