entities Within 2 years after the date of the enactment of this Act, a covered entity shall take reasonable steps, taking account of available technology, to provide users the ability to directly delete the covered data collected by the covered entity. (e) Default settings A covered entity may require, through terms of service or otherwise, that a user must consent to the transfer of covered data in order to use the service of the covered entity. (f) Policies regarding data from minors A covered entity may not collect, retain, or transfer the covered data of a user to a third party without affirmative consent from the parent or guardian of the user if the user is below the age of 18 years old, where technically feasible. (g) Prohibition on tracking cookies without user consent A commercial data operator— (1) unless authorized by the user, may not track cookies, including on mobile applications