; prohibited acts (a) Requirements (1) Search for DNT signal The operator of any covered website, service, or application (or any program that appears in such a website, application, or service) shall ensure that the website, service, or application (or program) searches for the DNT signal whenever a connected device connects to the website, service, or application. (2) Mandatory disclosure (A) In general Subject to subparagraph (B), if the operator of a covered website, service, or application collects more data from a user of such website, service, or application than is necessary to operate such website, service, or application the operator shall, through a pop-up notification, provide any user whose connected device is not sending the DNT signal with— (i) notice of the website, service, or application's policy of collecting data beyond what is necessary to operate the website, service, or application; (ii) notice of the protections from data collection and targeted advertising available to users under this Act; (iii) notice that the user may, through the public website of the Federal Trade Commission, download the Do Not Track program described in section 3(b), and a link to such website; and (iv) notice that the user may be able to activate the DNT signal through the user's device or browser. (B) Number and timing of disclosures The operator of a covered website, service, or application shall make the disclosures required under subparagraph (A)— (i) the first time a connected device connects to such website, service, or application