I can name two things missing besides opt-in and compensation:

* selected user's age;

* proper disclosure.