Where processing rests on consent the controller must be able to demonstrate it. A consent request inside a written declaration covering other matters must be clearly distinguishable, intelligible, easily accessible and in clear and plain language, and any part infringing the Law is not binding. The data subject may withdraw consent at any time, must be told of this before consenting, and withdrawing must be as easy as giving consent; withdrawal does not make earlier processing unlawful. Consent is not free where there is coercion, pressure or inability to exercise free will, especially from unequal positions, and account is taken of whether a contract or service is made conditional on consent to processing it does not need. For consent-based processing of a minor's data in the online provision of goods or services, the minor must be at least 16; below 16, consent must be given or authorised by a parent or legal custodian.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.