A controller must honour a consumer's opt-out of processing for targeted advertising, for the sale of personal data, and for profiling in furtherance of decisions producing legal or similarly significant effects. Under 501.72(1)(c), continuing to sell or share after an opt-out carries tripled penalties.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.