Except as the Act provides, a controller may not process personal data for purposes that are not reasonably necessary to, or compatible with, the purposes disclosed to the consumer unless it obtains the consumer's consent.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.