What is specifically required is pretty clear: You must provide the user with a detailed description of what personal data of theirs you are collecting, who yo

What is specifically required is pretty clear: You must provide the user with a detailed description of what personal data of theirs you are collecting, who you are sharing it with and what your business purpose for collecting it is, and if the data is something that you need their consent to collect, you get their explicit consent to collect that data and you must let them opt-out of providing that consent without preventing them from doing business with you.