; and (E) is provided free of charge. (3) Additional requirements for privacy and data use policy The privacy, security, and data use policy required under paragraph (2) shall include the following: (A) Identity and contact information of the entity collecting the sensitive personal information. (B) The purpose or use for collecting, storing, processing, selling, sharing, or otherwise using the personal information, including how the sensitive personal information is shared with third parties. (C) Third parties with whom the sensitive personal information will be shared and for what purposes. (D) The storage period for how long the personal information will be retained by the operator and any third party, as applicable. (E) How consent to collecting, storing, processing, selling, sharing, or otherwise using the sensitive personal information, including sharing with third parties, may be withdrawn. (F) How a user can view the sensitive personal information that they have provided to an operator and whether it can be exported to other web-based platforms. (G) What kind of sensitive personal information is collected. (H) Whether the sensitive personal information will be used to create profiles about users. (I) How sensitive personal information is protected from unauthorized access or acquisition. (4) Opt out consent For any collection, storage, processing, selling, sharing, or other use of non-sensitive personal information, including sharing with third parties, Operators shall provide users with the ability to opt out at any time. (5) Privacy audits (A) In general Annually, Operators collecting, storing, processing, selling, sharing, or otherwise using sensitive personal information shall obtain a privacy audit from an objective, independent third-party professional with substantial experience in the field of privacy and data protection, who uses procedures and standards generally accepted in such field. (B) Audit requirements Each such audit shall— (i) set forth the privacy, security, and data use controls that