Any for-profit person that conducts business in Florida and collects consumers' personal data (the first three limbs of the controller definition, without the 1 billion dollar revenue test) may not sell sensitive data without the consumer's prior consent, or for a known child without the child's affirmative authorisation at 13 to 17 or COPPA compliance under 13, and must post the sensitive data sale notice; violations carry the 501.72 penalties.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.