; and (v) be provided to the Federal Trade Commission or to the attorney general of a State, or other authorized State officer, within 10 days of notification by the Commission or the attorney general of a State, or other authorized State officer where such person has presented to the Operator allegations that a violation of this Act or any regulation issued under this Act has been committed by the Operator. (C) Small business exemption Notwithstanding other authorities of the FTC, the audit requirements set forth above shall not apply to Operators with 500 or fewer employees. (D) Non-sensitive personal information exemption The audit requirements set forth above shall not apply to Operators who do not collect, store, process, sell, share, or otherwise use sensitive personal information. (b) Exemptions (1) Necessary operations and security purposes Subsection (a) shall not apply to the processing, collecting, storing, sharing, selling of sensitive personal information for the following purposes: (A) Preventing or detecting fraud. (B) Protecting the security of people, devices, networks, or facilities. (C) Protecting the health, safety, rights, or property of the covered entity or another person. (D) Responding in good faith to valid legal process or providing information as otherwise required or authorized by law. (E) Monitoring or enforcing agreements between the covered entity and an individual, including but not limited to, terms of service, terms of use, user agreements, or agreements concerning monitoring criminal activity. (2) Reasonable expectation of users The regulations promulgated pursuant to subsection (a) with respect to the requirement to provide opt in consent shall not apply to the processing of sensitive personal information or behavioral data in which such processing does not deviate from purposes consistent with an operator’s relationship with users as understood by the reasonable user. 3. Application and enforcement by the Federal Trade Commission (a) General application This Act applies,