; and (B) to express a preference under subsection (e)(2). (2) Form A covered data broker shall ensure that the notice the covered data broker places under paragraph (1) conforms to such model form as the Commission shall promulgate for purposes of this subsection. (e) Certain marketing information (1) In general A covered data broker may not use, share, or sell any information for marketing purposes that is subject to an expressed preference under paragraph (2). (2) Expression of preferences A covered data broker that maintains any information described under subsection (a) and that uses, shares, or sells that information for marketing purposes shall provide each individual whose information the covered data broker maintains with a reasonable means of expressing a preference not to have that individual's information used for those purposes. (f) Auditing (1) In general Subject to paragraph (2), each covered data broker shall establish measures that facilitate the auditing or retracing of any internal or external access to, or transmission of, any data containing personal information collected, assembled, or maintained by the covered data broker. (2) Exceptions The Commission may establish, by rule, such exceptions to paragraph (1) as the Commission considers appropriate to further or protect law enforcement or national security activities. (g) Persons regulated by the Fair Credit Reporting Act A covered data broker shall be considered to be in compliance with this section with respect to information that is subject to the Fair Credit Reporting Act ( 15 U.S.C. 1681 et seq.) if the covered data broker is in compliance with sections 609, 610, and 611 of that Act ( 15 U.S.C. 1681g , 1681h, 1681i). 6. Regulations (a) In general Not later than 1 year after the date of the enactment of this Act, the Commission shall promulgate regulations under section 553 of title 5, United States Code, to carry out this Act. (b) Elements The regulations promulgated under subsection (a) shall include the following: (1) Such exceptions