A controller that sells personal data, processes it for targeted advertising or profiles in furtherance of significant decisions must disclose that processing in the privacy notice and give a clear and conspicuous opt-out method outside the notice, such as a link labelled "Your Opt-Out Rights" or "Your Privacy Rights" that directly effects the opt-out or leads to a page where it can be made.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.