Consent must be given in writing or by another means that shows the data subject's will; written consent must sit in a clause highlighted from the other contractual clauses. The controller bears the burden of proving consent was obtained lawfully; processing under a defect of consent is prohibited; consent must refer to determined purposes and generic authorisations are void. Consent may be revoked at any time by an express, free and facilitated procedure, with processing done before revocation remaining valid until erasure is requested. Where the information on purpose, form and duration, controller identity or shared use changes, the controller must inform the data subject, highlighting the changes, and the data subject may revoke consent if they disagree.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.