; or (2) repeatedly facilitates fraudulent or malicious activity. (f) Duties of a custodial third-Party agent A custodial third-party agent— (1) shall reasonably safeguard the privacy and security of user data provided to it by a user, or accessed on a user’s behalf; (2) shall not access or manage a user’s online interactions, content, or account settings in any way that— (A) will benefit the custodial third-party agent to the detriment of the user; (B) will result in any reasonably foreseeable harm to the user; or (C) is inconsistent with the directions or reasonable expectations of the user; and (3) shall not collect, use, or share any user data provided to it by a user, or accessed on a user’s behalf, for the commercial benefit of the custodial third-party agent. (g) Fees A custodial third-party agent may charge users a fee for the provision of the products or services described in subsection (a). (h) Extent of access rights Nothing in this section shall be construed to confer greater rights of access for a custodial third-party agent to a large communications platform than are accessible to a user. 6. Implementation and enforcement (a) Regulations Not later than 1 year after the date of enactment of this Act, the Commission shall promulgate regulations to implement section 4(c)(2)(B)(v) and subsections (b), (c), and (d) of section 5. (b) Authentication Not later than 180 days after the date of enactment of this Act, the Commission, in consultation with relevant industry stakeholders, shall establish rules and procedures to facilitate the verification of the validity of requests from users and competing communications providers to obtain user data under sections 3(a) and 4(a). (c) Technical standards Not later than 180 days after the date of enactment of this Act, the Director of the National Institute of Standards and Technology shall develop and publish model technical standards by which to make interoperable popular classes of communications or information services, including— (1) online messaging