entity whose notice or consent process is approved under paragraph (1) shall permit a small business to freely use such process, or a derivative thereof, as described in subparagraph (A). (C) No published process In the case of a small business for which there is no approved notice or consent process published under paragraph (3) of a covered entity that collects, processes, maintains, or discloses personal information in substantially the same way as such small business, any requirement under this title for a notice or consent process to be objectively shown to meet the threshold established by the Director under subsection (a) shall not apply to such small business. Nothing in the preceding sentence exempts a small business from the requirement to use such notice or consent process or that such process be concise and clear. (D) Inapplicability to privacy policy Paragraph (4) does not apply with respect to a privacy policy. (5) Minor changes A covered entity may make minor changes in a notice or consent process or privacy policy approved under paragraph (1) and retain the presumption under paragraph (2) for such process or policy without retesting or resubmission of testing data to the Director. 209. Prohibition on dark patterns in notice and consent processes and privacy policies In providing notice, obtaining consent, or maintaining a privacy policy as required by this title, a covered entity may not intentionally take any action that substantially impairs, obscures, or subverts the ability of an individual to— (1) understand the contents of such notice or such privacy policy