; (ii) does not directly collect personal information from or control the mechanism for collecting personal information from an individual; (iii) does not earn revenue from processing, maintaining, or disclosing personal information disclosed to the service provider by a covered entity except by providing contracted services to another covered entity; (iv) does not disclose personal information to another covered entity unless it was provided by that covered entity or resulted from maintaining or processing performed on personal information exclusively provide by that covered entity; (v) does not offer services that allow another covered entity to target specific individuals using personal information not provided by that covered entity; (vi) assists a covered entity on behalf of which it processes personal information to comply with title I, with respect to personal information processed or maintained by the service provider on behalf of the covered entity, including providing tools for such covered entities requirements under title I if requested; and (vii) does not link the personal information provided by another covered entity to personal information from any other source. (B) Any such person, and the personal information they disclose, process, or maintain, shall be treated as a service provider under this Act only to the extent that such person complies with the requirements under (A). (22) Significant privacy harm The term significant privacy harm means adverse consequences to an individual arising from the collection, processing, maintenance, or disclosure of personal information, limited to subparagraph (A), (B), or (D) of paragraph (14). (23) Small business The term small business means a covered entity that— (A) does not earn revenue from the sale of personal information; (B) earns less than half of annual revenues from the processing of personal information for targeted or personalized advertising