A controller must give a reasonably accessible and clear privacy notice listing the categories of personal data processed (including any sensitive data), purposes, how to exercise and appeal rights, categories of data shared with third parties and categories of those third parties, and the request methods under s 541.055; if it sells personal data or runs targeted advertising it must clearly and conspicuously disclose that and how to opt out.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.