D.C. Mun. Regs. tit. 26, r. 26-A3604
Except as otherwise authorized in this regulation, a licensee may not, directly or through any affiliate, disclose any nonpublic personal information about a consumer to a nonaffiliated third party unless:
Opt out means a direction by the consumer that the licensee shall not disclose nonpublic personal information about that consumer to a nonaffiliated third party, other than as permitted by §§ 3606, 3607 and 3608.
A licensee provides a consumer with a reasonable opportunity to opt out if the licensee mails the notices required in § 3604.1 to the consumer and allows the consumer to opt out by mailing the form, calling a toll free number or any other reasonable means within a minimum of 30 days from the date the licensee distributed the notice.
For an isolated transaction, such as the purchase of travel insurance for a single trip, or providing the consumer with an insurance quote, the licensee provides a reasonable opportunity to opt out if it provides the consumer with the required notices at the time of the transaction and request that the consumer decide, as a necessary part of the transaction, whether to opt out before completing the transaction.
A licensee shall comply with the applicable opt out requirements, regardless of whether the licensee and the consumer have established a customer relationship.
Unless a licensee complies with this section, the licensee may not, directly or through any affiliate, disclose any nonpublic personal information about a consumer that it has collected, regardless of whether the licensee collects it before or after receiving the direction to opt out from the consumer.
A licensee may allow a partial opt out to a consumer to select certain nonpublic personal information or certain nonaffiliated third parties with respect to which the consumer wishes to opt out.
A licensee may require each consumer to opt out through a specific means, as long as that means is reasonable for that consumer.
D.C. Mun. Regs. tit. 26, r. 26-A3604