For how many years following the consumer's request for the extended alert must the consumer be excluded from lists provided to third parties?

The correct answer is that a consumer must be excluded from lists provided to third parties for a period of 5 years following the request for an extended alert. Under the Fair Credit Reporting Act (FCRA), an extended fraud alert can be placed on a consumer's credit report to help protect them from identity theft, particularly if they believe they may be a victim. When a consumer places this alert, it serves as a notice to potential creditors and other third parties to take extra steps to verify the consumer's identity before extending credit.

This provision aims to enhance consumer protection and gives individuals time to recover and secure their identity after a potential fraud incident. The duration of 5 years is specifically designed to balance the protection of consumers with the need for creditors to have access to accurate credit data while still ensuring heightened security for those who have requested an extended alert.

The other options reflect periods that are shorter than what is mandated by the FCRA. The law is clear in establishing a 5-year timeline, which underscores the need for vigilance in identity protection efforts.