; and (D) may not use personal information of the individual for a purpose not specified in the short-form notice most recently provided to the individual in accordance with subparagraph (A) unless the covered entity provides the individual with a new short-form notice consistent with that paragraph that discloses the additional purpose. (c) Standardized short-Form privacy notice (1) Standardized notice The Commission shall establish standardized short-form privacy notices that comply with this section. (2) Use of standardized notice A covered entity may satisfy the requirements of subsection (a) by adopting a standardized short-form privacy notice established by the Commission under paragraph (1) of this subsection. (d) Joint notice for affiliated covered entities Two or more affiliated covered entities may use a single joint short-form notice for purposes of this section if the short-form notice— (1) states that the notice applies to multiple affiliated covered entities and names each such covered entity; and (2) is accurate with respect to the actions of each covered entity using the notice. 5. Right to control (a) Opt-In approval required In promulgating regulations under section 3, the Commission shall require a covered entity to obtain opt-in approval from an individual to— (1) collect, use, retain, share, or sell the individual’s personal information