; (II) of reasonable length; and (III) clearly distinguishable from other matters; and (ii) uses language that is clear, concise, and well organized, and follows other best practices appropriate to the subject and intended audience. (D) Privacy or security program An operator of a covered online platform shall— (i) establish and maintain a privacy or security program for the online platform; and (ii) publish a description of the privacy or security program that— (I) details how the operator will use the personal data of a user of the online platform, including requirements for how the operator will address privacy risks associated with the development of new products and services; and (II) includes details of the access that employees and contractors of the operator have to the personal data of a user of the online platform, and internal policies for the use of that personal data. (2) New products; changes to privacy or security program An operator of a covered online platform may not introduce a new product, or implement any material change to the privacy or security program of the online platform that overrides the privacy preferences of a user of the online platform, as specified under paragraph (1)(A)(ii), unless the operator has— (A) informed the user that the new product or change will result in the collection and use of personal data described in paragraph (1)(A)(i), if that is the case; (B) provided the user the option under paragraph (1)(A)(ii); and (C) obtained affirmative express consent from the user to the introduction of the new product or the implementation of the change. (3) Withdrawal of consent An operator of a covered online platform shall ensure that— (A) a user of the online platform is able to withdraw consent to the terms of service for use of the online platform, including the collection and use of personal data described in paragraph (1)(A)(i), as easily as the user is able to give such consent