A controller must obtain the consumer's consent before processing sensitive data (racial or ethnic origin, religious beliefs, a health diagnosis by a health care provider, sexual orientation, citizenship or immigration status, genetic or biometric identification data, data from a known child, precise geolocation), and must process a known child's sensitive data in line with COPPA.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.