; or (ii) the individual has consented to receive such notification and the notification is provided in a manner that is consistent with the provisions permitting electronic transmission of notifications under section 101 of the Electronic Signatures in Global and National Commerce Act ( 15 U.S.C. 7001 ). (2) Website notification The covered entity shall also provide conspicuous notification on the Internet website of the covered entity (if such covered entity maintains such a website) for a period of not less than 90 days. (3) Media notification If the number of residents of a State whose personal information was, or is reasonably believed to have been, acquired or accessed by an unauthorized person, or used for an unauthorized purpose, exceeds 5,000, the covered entity shall also provide notification in print and to broadcast media, including major media in metropolitan and rural areas where the individuals whose personal information was, or is reasonably believed to have been, acquired or accessed by an unauthorized person, or used for an unauthorized purpose, reside. (4) Content of notification (A) In general Regardless of the method by which notification is provided to an individual under paragraphs (1), (2), and (3), such notification shall include— (i) a description of the personal information that was, or is reasonably believed to have been, acquired or accessed by an unauthorized person, or used for an unauthorized purpose; (ii) a general description of the incident and the date or estimated date of the breach of security and the date range during which the personal information was compromised; (iii) the acts the covered entity, or the agent of the covered entity, has taken to protect personal information from further breach of security