A controller must not process a consumer's personal data for targeted advertising or sell it without consent where it has actual knowledge, or since 2025 wilfully disregards, that the consumer is at least 13 and under 16.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.