The world is waiting for your user-facing legal agreements to reflect this.

Explicitly stating that user data will not be used unless someone affirmatively opts-in in the agreement would be a good step.