The operator must retain a child's personal information only as long as reasonably necessary for the specific purposes for which it was collected, delete it when no longer needed using reasonable measures against unauthorised access or use in deletion, never retain it indefinitely, and establish, implement and maintain a written data retention policy stating the purposes of collection, the business need for retention and a deletion timeframe, provided in the online notice under 312.4(d).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.