Personal information may be collected without prior consent only: online contact information and names solely to seek consent (deleted if consent is not obtained in a reasonable time); a parent's contact information to give voluntary notice of participation in a service collecting nothing else; a child's contact information to respond once to a specific request, then deleted; child and parent contact information to respond more than once, with notice to the parent (undeliverable notice is not reasonable effort); names and contact information to protect a child's safety, with notice; a child's name and contact information to protect the security or integrity of the service, take precautions against liability, respond to judicial process or assist law enforcement; a persistent identifier alone for support for internal operations, with online notice; a persistent identifier from a user whose earlier registration shows they are not a child, on services directed to children only under the second limb of the definition; and an audio file of a child's voice alone to respond to a specific request, not otherwise used or disclosed and deleted immediately, with online notice. Each exception limits use to its stated purpose.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.