A controller that sells sensitive data must post the notice "NOTICE: This website may sell your sensitive personal data." and one that sells biometric data must post "NOTICE: This website may sell your biometric personal data.", both posted with the privacy notice. The sensitive data notice is also required of any person covered by 501.715.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.