A privacy notice must explain what information is collected from the consumer, where the information will be shared, how it will be used, the consumer's right to opt-out of information sharing with unaffiliated third parties, and must be provided when the relationship is established and annually thereafter.