; and (D) require the covered entity to notify the consumer of his or her right, and how to exercise that right, to later withdraw consent for the covered entity to not be bound by the consumer’s opt out; (7) not less frequently than every 2 years, examine the information that is presented to consumers in accordance with the procedures described in paragraph (6) to make sure that the information is useful, understandable, and to the extent possible, does not result in notification and consent fatigue; (8) establish standards and procedures requiring that when a non-covered entity that is not the consumer shares personal information about that consumer with a covered entity, the covered entity shall make reasonable efforts to verify the opt-out status of the consumer whose personal information has been shared with the covered entity, after which the covered entity may only store or use that personal information for the benefit of the covered entity— (A) if the consumer has not opted out in the manner described in paragraph (2)(A); or (B) (i) if the non-covered entity knowingly enabled or facilitated the collection of personal information by the covered entity and the covered entity itself receives consent from the consumer to store or use the consumer’s personal information in accordance with paragraph (9); or (ii) if the non-covered entity otherwise shares the information with the covered entity and the consumer has given consent in accordance with paragraph (9) to the covered entity or non-covered entity for the non-covered entity to share the consumer’s personal information with the specific covered entity