The participant maintains and abides by a Privacy Statement written by it and approved by ESRB, or written by ESRB, that clearly sets out its Online Information Practices, links only to and from English-language pages unless translated and localised, and discloses at minimum: certification by the program; how to contact the participant with name, postal and email address; how to contact ESRB; every item of PID collected, how it is collected and how used; the identity and addresses of all entities collecting or maintaining PID on the product's behalf; the entities with whom PID is shared, their types of business, purposes and whether they have agreed to keep it confidential and secure; whether PID is supplemented from other sources and which; the tracking technologies used; when and how users may opt in or out; the security measures in place; that PID may be disclosed under subpoenas, warrants or orders; that anything posted in public forums may be shown publicly; how users will be told of material changes; and the effective or last-updated date.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.