Where consent is the basis for offering information society services directly to a child, processing is lawful only if the child is at least 16; below 16, only if and to the extent that the holder of parental responsibility gives or authorises consent. The controller must make reasonable efforts, taking available technology into account, to verify that consent was given or authorised by the holder of parental responsibility. Contract law rules on a child's contracts are unaffected.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.