Controllers and processors must respond to the AG's civil investigative demands and, on a notice of alleged violations, cure within 30 days and give a written statement that they cured the violation, notified the affected consumer where contact details were available, with supporting documentation, and changed internal policies to prevent recurrence; breaching the statement or continuing violations exposes them to penalties up to $7,500 per violation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.