A controller must provide an effective mechanism for a consumer to revoke consent that is at least as easy as the mechanism used to give it, and on revocation must cease processing the data as soon as practicable and no later than 15 days after receiving the request (paragraph (6) before the 2026 renumbering).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.