; (F) (i) restrict the sharing of the geolocation of the user; and (ii) provide notice regarding the tracking of the geolocation of the user; and (G) limit time spent by the user on the platform; and (2) by default, set the safeguards provided under paragraph (1) at the most protective setting. 2414. Duty of confidentiality; data collection and processing (a) Requirement for a legitimate basis for processing data A covered entity may only process the personal data of a person if 1 or more of the following applies: (1) Processing is necessary— (A) for the performance of a contract to which the person is party; or (B) in order to take steps at the request of the person before entering into a contract. (2) Processing is necessary for compliance with a legal obligation to which the covered entity is subject. (3) Processing is necessary in order to protect the vital interests of the person or another individual. (4) Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the covered entity. (5) Processing is necessary for the purposes of the legitimate interests pursued by the covered entity, unless those interests are overridden by the interests (including constitutional rights, civil rights, and civil liberties) of the person that require protection of personal data, in particular if the person is a child. (b) Purpose limitation requirement A covered entity— (1) shall articulate to a person through clear and conspicuous disclosure a specific, explicit, and legitimate purpose for any processing of personal data of the person