A controller must not process personal data in violation of state and federal anti-discrimination laws, and must not discriminate against a consumer for exercising rights by denying goods or services, charging different prices or rates, or giving a different level or quality; it may still offer different terms tied to an opt-out or to a bona fide loyalty, rewards, premium features, discount or club card program, and need not provide a product that requires data it does not collect.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.