Where the operator relies on the Internal Operations Exception to collect persistent identifiers (or limited other PI) without VPC, it limits the use to support of internal operations as defined by COPPA (e.g. authentication, security, frequency capping, debugging, legal compliance), prohibits combining with other PI for outside-internal-operations uses, and records the basis.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.