; (II) the reasonable expectations of consumers; (III) research on deceptive practices; (IV) the role of deceptive user interfaces; and (V) the impact of such regulations on small businesses. (2) Requirements for opt-out consent Except as provided in subsection (b), require covered entities to provide individuals with conspicuous access to a method that is in easily understandable language, concise, accurate, clear, to opt-out of any collection, processing, storage, or disclosure of covered data linked to the individual. (3) Requirements for affirmative consent Except as provided in subsection (b), require covered entities to provide individuals with a notice that is concise, in easily understandable language, accurate, clear, timely, and conspicuous to express affirmative, opt in consent— (A) before the covered entity collects or discloses sensitive data linked to the individual; or (B) before the covered entity collects, processes, stores, or discloses data for purposes which are outside the context of the relationship of the covered entity with the individual linked to the data, including— (i) the use of covered data beyond what is necessary to provide, improve, or market a good or service that the individual requests; (ii) the processing or disclosure of covered data differs in material ways from the purposes described in the privacy policy that was in effect when the data was collected; (iii) any other purpose that Commission considers outside of context. (4) Data minimization requirements Except as provided in subsection (b), require covered entities to— (A) take reasonable measures to limit the collection, processing, storage, and disclosure of covered data to the amount that is necessary to carry out the purposes for which the data is collected