; and (B) to express a preference under subsection (e)(2). (2) Form A covered data broker shall ensure that the notice the covered data broker places under paragraph (1) conforms to such model form as the Commission shall promulgate for purposes of this subsection. (e) Certain marketing information (1) In general A covered data broker may not use, share, or sell any information for marketing purposes that is subject to an expressed preference under paragraph (2). (2) Expression of preferences A covered data broker that maintains any information described under subsection (a) and that uses, shares, or sells that information for marketing purposes shall provide each individual whose information the covered data broker maintains with a reasonable means of expressing a preference not to have that individual's information used for those purposes. (f) Auditing (1) In general Subject to paragraph (2), each covered data broker shall establish measures that facilitate the auditing or retracing of any internal or external access to, or transmission of, any data containing personal information collected, assembled, or maintained by the covered data broker. (2) Exceptions The Commission may establish, by rule, such exceptions to paragraph (1) as the Commission considers appropriate to further or protect law enforcement or national security activities. (g) Security (1) In general Each covered data broker shall develop and implement a comprehensive consumer privacy and data security program to protect against harm that may be caused by— (A) loss of personal information collected, assembled, or maintained by the covered data broker