AIS: In the U.S., organizations are allowed to collect personal information about customers unless the customer explicitly objects (called opt-out). In contrast, the default policy in EU is opt-in, meaning that organizations cannot collect personally identifying information unless customers explicitly give them permission to do so. What are the advantages and disadvantages to the opt-in versus the opt-out approaches?