; and (2) may not process personal data in a manner that is incompatible with the purpose articulated under paragraph (1). (c) Data minimization requirement A covered entity shall ensure that all personal data that the covered entity collects and processes is adequate, relevant, and limited to what is necessary in relation to the purposes for which the covered entity processes the personal data. (d) Accuracy requirement A covered entity shall— (1) ensure that personal data that the covered entity maintains regarding a person is accurate; (2) where necessary, keep the personal data described in paragraph (1) up-to-date; and (3) take every reasonable step to erase or rectify without delay any personal data that the covered entity maintains regarding a person that is inaccurate. (e) Storage limitation requirement A covered entity shall ensure that personal data that the covered entity maintains regarding a person is kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the data is processed. (f) Governmental entities A covered entity may not transfer to, share with, or otherwise provide or make available to any governmental entity personal data absent a search warrant, except in accordance with rules promulgated by the Commission to implement this section. (g) Rulemaking The Commission shall promulgate rules to implement this section and to protect the confidentiality of personal data. 2415. Limitations on targeted advertising (a) Prohibited cross-Platform targeted advertising A covered entity that is an operator of a platform may not target advertising to a user of the platform based on the user’s personal data obtained from the user’s activity across other, distinctly branded platforms. (b) Permissible targeted advertising A covered entity that is an operator of a platform may target advertising to a user of the platform— (1) based on the user’s first-party personal data obtained from the user’s activity on that platform