I know you are supposed to make it clear that you are collecting data, and allow opt out.

Just to be clear, the GDPR requires opt-*in* for any data for which you do not have a legitimate interest - that you means you need consent before you start collecting.