; (C) uses clear and plain language; (D) uses visualizations where appropriate to make complex information understandable by the ordinary user; and (E) is provided free of charge. (3) Additional requirements for privacy and data use policy The privacy, security, and data use policy required under paragraph (2) shall include the following: (A) Identity and contact information of the entity collecting the sensitive personal information. (B) The purpose or use for collecting, storing, processing, selling, sharing, or otherwise using the sensitive personal information. (C) Third parties with whom the sensitive personal information will be shared and for what purposes. (D) The storage period for how long the sensitive personal information will be retained by the controller and any third party, as applicable. (E) How consent to collecting, storing, processing, selling, sharing, or otherwise using the sensitive personal information, including sharing with third parties, may be withdrawn. (F) How a user can view or obtain the sensitive personal information that they have provided to a controller and whether it can be exported to other web-based platforms. (G) What kind of sensitive personal information is collected and shared. (H) Whether the sensitive personal information will be used to create profiles about users and whether they will be integrated across platforms. (I) How sensitive personal information is protected from unauthorized access or acquisition. (4) Opt-out consent For any collection, storage, processing, selling, sharing, or other use of non-sensitive personal information, including sharing with third parties, controllers shall provide users with the ability to opt out at any time. (5) Privacy audits (A) In general Except as provided in subparagraphs (C) and (D), annually, each controller collecting, storing, processing, selling, sharing, or otherwise using sensitive personal information shall— (i) obtain a privacy audit from a qualified, objective, independent third-party