Controllers that sell sensitive personal data must post the exact notice: 'NOTICE: We may sell your sensitive personal data.' Controllers that sell biometric personal data must post: 'NOTICE: We may sell your biometric personal data.' Notices must be in the same location and manner as the privacy notice.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.