; and (II) the ways that the data of a user of the commercial data operator is used if the use is not directly or exclusively related to the online service that the commercial data operator provides to the user; and (B) except as provided in paragraph (2), provide a user of the commercial data operator with the ability to delete all data, in the aggregate and for an individual field, that the commercial data operator possesses, or maintains control or access to with respect to the user, through— (i) a single setting; or (ii) another clear and conspicuous mechanism by which the user may make such a deletion. (2) Deletion exceptions (A) In general A commercial data operator shall comply with a user directive to delete, in whole or in part, the data of the user except— (i) in cases where there is a legal obligation of the commercial data operator to maintain the data; (ii) for the establishment, exercise, or defense of legal claims; or (iii) if the data is necessary to detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or assist in the prosecution of those responsible for such activity. (B) Retention A commercial data operator may not retain any more user data than is necessary to carry out an activity described in clauses (i) through (iii) of subparagraph (A). (3) Availability A commercial data operator shall ensure that all disclosures required under subsection (a) are available to a user of the commercial data operator— (A) on and after the date on which the commercial data operator makes the identification