; and (B) control what data they choose to allow the pilot program to share with a social media platform, without sharing copies of the underlying verification documents or any information that the user does not affirmatively agree to share with those social media platforms. (4) Not retain copies of underlying governmental records after verifying the information provided by the user. (5) Provide users with the ability to disable or delete their secure digital identification credential and any associated records kept by the Pilot Program at any time. (6) Keep no records of the social media platforms where users have verified their identity using a secure digital identification credential, other than aggregate data that is anonymized so that it cannot be linked to individual users. (c) Access Information regarding individual users of the Pilot Program shall be confidential, and no officer or employee of the United States, or any other person who has or had access to such information due to their involvement with the Pilot Program, shall disclose any such information to any entity, including law enforcement agencies, except— (1) with the consent of the user; (2) in connection with oversight by an Inspector General related to the proper implementation of this Act; (3) in connection with an investigation into a user for committing fraud against the Pilot Program