; and (B) fulfill the responsibilities described in paragraph (1) free of charge. (3) Prohibition on retaliation A covered entity shall provide the same quality of goods or services, at the same price or rate, regardless of whether a user took an action described under paragraph (1). (4) Retention of data A covered entity that collects data on a user’s browsing history or biometric data and information shall delete the data within 60 days after the date on which the data was collected. (c) Data minimization and contextuality (1) Collection and use of information A commercial data operator shall limit the collection and sharing of information by the operator with third parties to what is reasonably necessary to provide a service or conduct an activity that a consumer has requested or is reasonably necessary for fraud prevention. (2) Retention of information A commercial data operator that collects the personal information of a consumer shall limit the use and retention of that information to what is reasonably necessary to provide a service or conduct an activity that a consumer has requested or a related operational purpose. Any data collected or retained by a commercial data operator solely for security or fraud prevention may not be used for operational purposes. (3) Monetization Monetization of personal information shall not be considered reasonably necessary to provide a service or conduct an activity that a consumer has requested or reasonably necessary for security or fraud prevention. (d) Consumer choice and control (1) Commercial data operator A commercial data operator shall provide a prominently and conspicuously displayed icon a user may click to opt out of data collection on every unique website, mobile application, or computer application. (2) Covered entities Within 2 years after the date of the enactment of this Act, a covered entity shall take reasonable steps, taking account of available technology, to provide users the ability to directly delete the covered data collected by the covered entity.