Opt-Out should be part of your Privacy Notice at acct. opening & checking origination and annually.
Offering additional services like ODP is OK if the customer hasn't already exercised/used the Opt-out provision. Also the offer must be made to all "eligible for service" definitions written in your policy.
