Limited exceptions permit collection before consent: collecting a parent's or child's online contact information solely to obtain consent or provide notice; responding once directly to a child's specific one-time request; multiple-contact communications after notice (email-plus); protecting a child's safety; protecting the security or integrity of the service, taking precautions against liability, responding to judicial process, or complying with law; and collecting a persistent identifier solely to support internal operations.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.