A controller must allow a consumer to opt out of targeted advertising or sale through an opt-out preference signal sent with the consumer's consent by a platform, technology or mechanism that does not use a default setting, is consumer-friendly and lets the controller determine Minnesota residence (an IP-based location estimate suffices); where the signal conflicts with a controller-specific setting or loyalty programme participation the controller must honour the signal but may notify the consumer and offer a choice to confirm; recognising signals approved under other states' laws is compliance. Consumers may act through authorised agents for these opt-outs, including by browser setting, extension or global device setting, and a controller must comply if it can verify with commercially reasonable effort the consumer's identity and the agent's authority; parents of known children and court-appointed guardians or conservators may exercise the rights.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.