A consumer may opt out of processing for targeted advertising, the sale of personal data, and profiling in furtherance of automated decisions producing legal or similarly significant effects; the controller must comply as soon as feasibly possible and no later than 45 days after receipt. The controller need not authenticate an opt-out request but may deny one it believes in good faith, on a reasonable and documented basis, to be fraudulent, notifying the requester and stating the basis.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.