; or (B) once the data has outlived the legitimate purpose for which the data was collected; (3) obtain consent from the educational agency, institution, or program, through contracts or privacy policies in a manner that is clear and easy to understand, regarding the types of covered information collected, the purposes for which the covered information is used or disclosed to third parties, and the identity of any such third parties; (4) disclose publicly, on the website of the operator, every privacy policy that the operator has established with an educational agency, institution, or program; (5) obtain consent from the educational agency, institution, or program and provide sufficient notice on its website before making material changes to a contract or privacy policy for a school service