; (4) require covered entities that store or use personal data on consumers with which they— (A) do not have a direct relationship; or (B) otherwise do not have the ability to determine the consumer’s opt-out preference through one of the technological means established pursuant to paragraph (2)(B), to make a good-faith effort to determine the consumer’s opt-out status at least as frequently as determined by the Commission, through the Application Programming Interface maintained by the Commission pursuant to paragraph (2)(D); (5) permit covered entities to not be bound by the consumer’s opt out for— (A) disclosures made to the government that are either required or permitted by law; (B) disclosures made pursuant to an order of a court or administrative tribunal; (C) disclosures made in response to a subpoena, discovery request, or other lawful process provided that such process is accompanied by a protective order that— (i) prohibits the parties from using or disclosing the personal information for any purpose other than the litigation or proceeding for which such personal information was requested; and (ii) requires the return to the covered entity or destruction of the personal information (including all copies made) at the end of the litigation or proceeding; or (D) disclosures made to investigate, protect themselves and their customers from, or recover from fraud, cyber attacks, or other unlawful activity