A controller is not required to comply with a request from a consumer if the controller cannot authenticate the request using commercially reasonable efforts, and may request that the consumer provide additional information reasonably necessary to authenticate the request and the consumer's identity. The controller is not required to authenticate an opt-out request but may deny an opt-out request if the controller has a good faith, reasonable, and documented belief that the request is fraudulent.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.