; and (ii) the person is complying with the regulations promulgated under this Act; or (C) a person with respect to which the individual gave specific opt-in approval for the covered entity to disclose the personal information of the individual to the person. 3. Act prohibited (a) In general It shall be unlawful for a covered entity to violate the privacy of an individual in a manner that violates a regulation promulgated under this Act. (b) Regulations In carrying out this Act, the Commission shall— (1) not later than 1 year after the date of enactment of this Act, promulgate regulations under section 553 of title 5, United States Code, to protect the individual and collective privacy rights set forth in this Act; (2) ensure the regulations promulgated under paragraph (1) take effect not later than 90 days after the date on which the regulations are promulgated; (3) establish a centralized internet website for the benefit of individuals that provides information to individuals about their rights under this Act in a clear, concise, well-organized, understandably written, and complete manner; and (4) establish a centralized internet website for the benefit of individuals that lists each data broker in the United States. 4. Right to notice (a) In general In promulgating regulations under section 3, the Commission shall require a covered entity to— (1) develop and make available to customers a short-form notice about the collection, retention, use, and sharing of the personal information of individuals by the covered entity that includes— (A) what personal information is being collected, used, or retained; (B) the manner in which the personal information is collected; (C) how and for what purpose the covered entity is collecting, using, retaining, sharing, or selling the personal information; (D) how long the personal information will be held