Recognise and honour Universal Opt-Out Mechanism under Section 14-4604 - controllers MUST allow consumers to opt out of targeted advertising and sale of personal data through user-selected universal opt-out mechanism (Global Privacy Control GPC or equivalent). Mechanism must be (a) unaffiliated with the controller; (b) easy for reasonable consumer to use; (c) clearly described to consumer; (d) does not unfairly disadvantage another controller; (e) does not make use of a default that opt-out signal is set or unset which the consumer did not affirmatively select. Controller may not require consumer to actively select opt-out from a default that does not opt out. Effective from 1 October 2025 with no cure period for GPC failure to honour after first 24 months. Coordination with multistate GPC recognition by Colorado + Connecticut + Texas + California (CPRA via CCPA Regulation 7025) + Delaware + Montana + Nebraska + New Hampshire + New Jersey + Oregon. Implement signal-detection + audit log + consumer-confirmation. Browser fingerprinting and inference-based tracking opt-out also required.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.