I'm thinking of this bit: you're in scope if you provide the data for any kind of consideration. (Can't seem to link to sections.)
leginfo.legislature.ca.gov/faces/billText…
What interests me here is how to get to a situation in which there is only one controller, which is what GPC is going after. I'm aligning Do Not Sell with a withdrawal/objection (depending on basis) to processing by other controllers.