; (II) shall be provided in response to a request that includes the notice described in paragraph (2); and (III) cannot be inferred from inaction. (2) Notice required (A) In general In requesting the consent of an individual to collect or process the individual's personal data, a covered entity shall provide the individual with notice, in a concise, meaningful, timely, prominent, and easy-to-understand format, that includes— (i) the types of personal data collected and processed; (ii) a description of the purposes for which the covered entity seeks to collect or process that individual's personal data; and (iii) the information described in subparagraph (B). (B) Contents The notice provided by a covered entity under subparagraph (A) shall include— (i) information on how the individual may access the privacy policy of the covered entity described in section 4(a); (ii) information on how the individual may exercise the rights provided for under this Act; and (iii) notice of whether the collection or processing by the covered entity— (I) includes the disclosure of personal data to third parties; or (II) involves sensitive personal data. (C) Separation If consent is obtained in the context of a notice that also concerns matters other than the collection or processing of personal data, the request for consent shall be presented in a manner that is clearly distinguishable from the other matters. (3) Withdrawal of consent (A) In general A covered entity shall provide an individual with the means to withdraw previously given consent to collect or process the personal data of the individual— (i) at any time and place that is reasonably practicable; and (ii) in a manner that is as accessible as reasonably practicable. (B) Effect A withdrawal made under subparagraph (A)— (i) shall take effect without undue delay; (ii) shall remain in effect until the individual revokes or limits that denial or withdrawal