; and (ii) the person has obtained affirmative informed consent of the consumer for the procurement of the consumer report by that person. (B) Authorizations The consent described in subparagraph (A)(ii) shall be provided on the disclosure described under subparagraph (A)(i). (5) Rulemaking Not later than 270 days after the date of enactment of the Consumer Credit Control Act of 2023 , the Director of the Bureau shall promulgate regulations that— (A) implement this subsection; (B) establish a model form for the disclosure document pursuant to paragraph (4); (C) permit consumers to provide affirmative informed consent required by paragraph (1) for a specific time period for multiple users for the specified purpose during that time period; (D) require a consumer reporting agency— (i) to provide to each consumer a secure, convenient, accessible, and cost-free method, including by toll-free telephone or secure electronic means, by which a consumer may— (I) provide or revoke any affirmative informed consent pursuant to this subsection; and (II) make or revoke any election pursuant to paragraph (3)(B); (ii) to implement any provision or revocation of affirmative informed consent pursuant to this subsection not later than 1 business day after the date on which a consumer provides or revokes affirmative informed consent; and (iii) to implement any election or revocation of any election pursuant to paragraph (3)(B) not later than 1 business day after the date on which a consumer makes or revokes an election; and (E) define what constitutes affirmed informative consent in the manner that provides the greatest protection to consumers. (6) Prohibitions (A) In general The method described in paragraph (5)(D) shall not be used to— (i) collect any information on a consumer that is not necessary for the purpose of the consumer to allow or disallow the furnishing of consumer reports