3. Choice and consent. The organization describes the choices available to individuals and obtains their consent to the collection and use of their personal information. Note that the choices offered differ across countries. In the United States, the default policy is called opt- out, which allows organizations to collect personal information about customers unless the customer explicitly objects. In contrast, the default policy in Europe is opt-in, meaning that organizations cannot collect personally identifying information unless customers explicitly give them permission to do so.