; and (C) any other category of information the collection of which the Commission determines, consistent with paragraph (3), will not unduly burden user privacy; (3) defining reasonable measures to protect the privacy of the platform’s users under subsection (a)(3), including by specifying the measures that must be taken to— (A) avoid the collection and retention of non-public information that would readily identify a user without that user's consent; (B) prevent the theft and accidental disclosure of any information collected; (C) ensure that the information at issue is not used for any purpose other than to inform the general public about matters of public concern; and (D) restrict the publication or other disclosure of any information that would readily identify a user without the user's consent, except when such user is— (i) an advertiser and the data concerns an advertisement; or (ii) a public official, candidate for public office, or public figure; (4) defining reasonable measures to avoid misleading the platform’s users under subsection (a)(4)