A controller that sells personal data to third parties or uses it for targeted advertising must clearly and conspicuously disclose that activity and how consumers can opt out.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.