A controller must provide an effective mechanism for a consumer (or a known child's parent or guardian) to revoke consent that is at least as easy as the way consent was given, and on revocation stop processing the applicable data as soon as practicable and no later than 15 days after receiving the request.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.