; or (D) disclosures made to investigate, protect themselves and their customers from, or recover from fraud, cyber attacks, or other unlawful activity; (6) establish standards and procedures, including through an Application Programming Interface, for a covered entity to request, not more frequently than once per calendar year unless a consumer is signing up for a product or service, and obtain consent from a consumer who has opted out in the manner described in paragraph (1)(A) for the covered entity to not be bound by the opt out, provided such standards and procedures— (A) require the covered entity to provide the consumer, at the time the covered entity is seeking consent, in accordance with paragraph (10), and in a form that is understandable to a reasonable consumer— (i) a list of each third party with whom the personal information of the consumer will or may be shared by the covered entity; (ii) a description of the personal information of that consumer that will or may be shared; and (iii) a description of the purposes for which the personal information of that consumer will or may be shared; (B) if the covered entity requires consent as a condition for providing a product or service, require the covered entity to— (i) notify the consumer that he or she can obtain a substantially similar product or service in exchange for monetary payment or other compensation rather than by permitting the covered entity to share the consumer’s personal information, as provided in subsection (b)(1)(B); and (ii) with respect to the notice described in clause (i)— (I) make the notice in a clear and conspicuous manner; and (II) include the cost of the fee, if any, and instructions for obtaining the substantially similar product or service described in clause (i); (C) if the covered entity does not require consent as a condition for providing a product or service, require the covered entity to clearly and conspicuously notify the consumer that the consumer may refuse to provide consent but still obtain the product or service