; or (ii) advertising that is directed to a user by the operator of a website, online service, online application, or mobile application based on the search terms that the user used to arrive at such website, service, or application. (6) User data The term user data means any information obtained by an entity that provides a data-based service such as a website or internet application that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked with an individual who is a citizen or resident of the United States without regard to whether such information is directly submitted by the individual to the entity, is derived by the entity from the observed activity of the individual, or is obtained by the entity by any other means. 3. Data security requirements for covered technology companies (a) In general The following requirements shall apply to a covered technology company: (1) Minimal collection of data The company shall not collect any more user data than is necessary for the operation of the website, service, or application of the company. (2) Prohibition on secondary uses The company shall not use any user data collected under paragraph (1) for any purpose that is secondary to the operation of the website, service, or application of the company, including providing targeted advertising, unnecessarily sharing such data with a third party, or unnecessarily facilitating facial recognition technology. (3) Right to view and delete data The company shall allow an individual to— (A) view any user data held by the company that relates to the individual