No later than six months after the effective date (15 July 2025), a controller that processes personal data for targeted advertising or sale must let consumers opt out of that processing through a user-selected universal opt-out mechanism. The mechanism must not let its maker unfairly disadvantage other controllers, must not default consumers into processing or sale unless the controller determines the default reflects the consumer's affirmative, freely given and unambiguous choice, must be consumer-friendly, clearly described and easy to use, as consistent as possible with similar mechanisms required elsewhere, and must let the controller determine whether the consumer is a New Jersey resident and whether the request is legitimate. The Division may adopt technical specifications for such mechanisms (166.11(c)).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.