Except as the Act otherwise provides, a controller must not process personal data for purposes that are neither reasonably necessary to nor compatible with the purposes disclosed to the consumer unless it obtains the consumer's consent.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.