A controller must honour a consumer's opt-out of the collection of sensitive data, including precise geolocation data, and of the processing of sensitive data (in addition to the consent required by 501.71(2)(d)).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.