A controller may not process a consumer's sensitive data without consent. For a known child aged 13 to 17 it must have the child's affirmative authorisation, and for a known child under 13 it must process in accordance with COPPA. Under 501.72(1)(a), violations involving a known child carry tripled penalties and no cure period.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.