; and (ii) unless the user of the connected device opts out of receiving such disclosures, at least every 30th time a connected device connects to such website, service, or application. (C) Collection of data for targeted advertising For purposes of this subsection, a covered website, service, or application that collects data for the purpose of designing or displaying targeted advertisements shall be considered to be collecting more data than is necessary to operate such website, service, or application. (b) Prohibition on data collection and targeted advertising (1) In general Subject to paragraph (3), it shall be unlawful for a first-party operator of a covered website, service, or application that receives the DNT signal from the connected device of a user to— (A) collect data (other than such data as is necessary for the operation of the website, service, or application) from the user; (B) use any data collected from the user for a secondary purpose, including for the purpose of targeted advertising; or (C) share any data collected from the user with a third party unless the user expressly consents to the sharing of data in a manner that demonstrates the user's intent for the first-party operator to be an intermediary between the user and the third party. (2) Prohibition on collection of data by other operators (A) In general It shall be unlawful for a third-party operator of a program (including a program that is an advertisement or a portal used to log in to a website, service, or application) that receives the DNT signal from the connected device of a user of a covered website, service, or application to collect any data from such user, other than, subject to subparagraph (B), data collected for the purpose of analyzing how or whether the user engaged with such program. (B) Limitations on collection of data for engagement analytics Data collected for the purpose of analyzing user engagement with a program described in subparagraph (A)— (i) shall be collected only in a de-identified manner