A controller that on or after 1 October 2025 offers an online service, product or feature to a consumer it actually knows or wilfully disregards is a minor must conduct a data protection assessment of it where there is a heightened risk of harm to minors, consistent with 30-14-2814 and addressing the purpose of the service, the categories of minors' data it processes, the purposes of processing, and any heightened risk of harm to minors reasonably foreseeable from offering it to them. One assessment may cover comparable operations, and an assessment for another law that is reasonably similar in scope and effect counts. The duty covers processing activities created or generated after 1 October 2025.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.