; and (B) except as otherwise required by law, no person is able to access the personal data of a user of the online platform later than 30 days after the date on which the user closes his or her account or otherwise terminates his or her use of the online platform. (b) Right to access An operator of a covered online platform shall offer a user of the online platform a copy of the personal data of the user that the operator has processed, free of charge and in an electronic and easily accessible format, including a list of each person that received the personal data from the operator for business purposes, whether through sale or other means. (c) Violations of privacy (1) In general Not later than 72 hours after an operator of a covered online platform becomes aware that the personal data of a user of the online platform has been transmitted in violation of the privacy or security program of the online platform, including the privacy preferences specified by the user under subsection (a)(1)(A)(ii), the operator shall— (A) notify the user of the transmission; (B) offer the user the option to elect to prohibit the operator from collecting and using the personal data of the user, subject to paragraph (2); (C) except as provided in paragraph (3), offer the user the option to have the operator— (i) erase all personal data of the user tracked by the operator; and (ii) cease further dissemination of personal data of the user tracked by the operator; (D) offer the user a copy of the personal data of the user that the operator has processed, free of charge and in an electronic and easily accessible format, including a list of each person that received the personal data from the operator, whether through sale or other means