A person that is a small business under the SBA definition, though otherwise outside the chapter, must not sell sensitive personal data without the consumer's prior consent and faces the chapter's civil penalty if it does.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.